A fully-obfuscated “AiWith” deploy plugin that runs local servers, shell-fetches code from a vendor CDN and uploads project files to three clouds — shipped with no README, license or disclosure
zen-app-plugin (“AiWith” / zen-aiwith) is a commercial IDE deploy plugin whose every shipped file is deliberately obfuscated (it even bundles javascript-obfuscator at runtime). It starts local bridge servers, uploads project files to vendor multi-cloud buckets (Volcengine TOS, Alibaba OSS, Tencent COS), downloads assets from a vendor CDN via shell curl (b.ebus.vip/zeto) and loads vendor frontend code (b.ebus.vip/thor/.../detail.js) into a webview — all with no README, license or disclosure of any kind. codelake found no credential theft, no install hook and no non-vendor endpoints, so this is not classified as malware — but a totally opaque package wielding shell execution, remote code loading and multi-cloud upload is a serious supply-chain trust risk.
zen-app-plugin version 1.0.6 (npm, bins zen/wap) is the client for a commercial “AiWith” (zen-aiwith) IDE deploy/collaboration platform. It runs local bridge servers on 127.0.0.1 that an IDE plugin drives, synchronises project files to the vendor's cloud, and renders a vendor-hosted web UI.
codelake independently flagged the version cluster during supply-chain triage. The package is opaque by construction: every file (bridge.js, index.js, the bin stubs) is obfuscator.io-obfuscated, and it ships no README, no license and no disclosure describing what it does or where data goes. The behaviour below was recovered by flag-safe static deobfuscation.
Read statically (no execution): the plugin uploads project web assets — readFileSync → gzip (pako) → putObject — to the vendor's multi-cloud storage (Volcengine TOS, Alibaba OSS, Tencent COS), using credentials provisioned by the vendor backend after an authenticated login (gatewaySecret, needLogin, 401 handling). It builds and runs a shell command (curl -o … https://b.ebus.vip/zeto/… > file) to fetch assets from the vendor CDN — the output is written to a file and is not piped into eval. Its HTML loads https://b.ebus.vip/thor/v0.0.2/detail.js as the vendor's frontend runtime in a webview.
codelake found no credential or secret harvesting (no SSH keys, .npmrc, .aws, keytar, browser data), no install hook, and every network destination is the vendor's own infrastructure (b.ebus.vip / zeto.me). By mechanism the obfuscation protects the vendor's own code and generated output. On that evidence it does not meet the bar for malware.
The Risky classification reflects an unusually opaque supply-chain posture: a package that combines total obfuscation, shell-driven remote fetches, remote code loaded into a webview and upload of a user's project files to three external clouds, while providing no documentation or disclosure for users to make an informed trust decision. This advisory records an independent detection; it does not assert a backdoor, dropper or data theft, none of which were proven. Because the code is obfuscated, the full set of files selected for upload could not be exhaustively verified.