@ainative/cody-cli@0.12.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@ainative/cody-cli@0.12.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cody.jsView file

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs') ... L15: L16: const CLI_BUNDLE = path.join(__dirname, '..', 'dist', 'cli.js') L17: const MIN_BUN_VERSION = '1.2.0' L18: L19: const IS_WINDOWS = process.platform === 'win32' L20: ... L22: // HOME on Windows is USERPROFILE; fall back to HOME for Unix L23: const home = process.env.USERPROFILE || process.env.HOME || '' L24: const candidates = IS_WINDOWS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cody.jsView on unpkg · L11

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

High

Child Process

Package source references child process execution.

bin/cody.jsView on unpkg · L11

69if (IS_WINDOWS) { L70: // Windows: use PowerShell installer (Refs #3117) L71: execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "irm bun.sh/install.ps1 | iex"', { stdio: 'inherit' })

High

Shell

Package source references shell execution.

bin/cody.jsView on unpkg · L69

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cody.jsView on unpkg · L11

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 22271141 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 22271141 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 7-47json

7 "bin": {

8 "cody": "bin/cody.cjs"

9 },

10 "files": [

11 "bin/",

12 "dist/cli.js",

13 ".ainative/skills/",

14 ".ainative/AINATIVE.md",

15 ".ainative/README.md",

16 ".ainative/SDK_PUBLISHING_GUIDELINES.md",

17 ".claude/hooks/",

18 ".claude/skills/",

19 ".cody/hooks/",

20 ".cody/skills/",

21 ".cody/CODY.md",

22 ".cody/mcp.json.example",

23 "cody",

24 "README.md"

25 ],

26 "scripts": {

27 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "build": "bash build.sh",

29 "start": "node dist/cli.js",

30 "postbuild": "bash postbuild.sh",

31 "test": "bun test",

32 "test:coverage": "bun test --coverage",

33 "test:e2e": "bun test tests/e2e/",

34 "prepublishOnly": "bun test && bash build.sh && bash postbuild.sh"

35 },

36 "homepage": "https://ainative.studio/cody",

37 "bugs": {

38 "url": "https://discord.gg/paipalooza"

39 },

40 "keywords": [

41 "cody",

42 "cody-cli",

43 "ainative",

44 "ai",

45 "ai-coding",

46 "ai-assistant",

47 "ai-agent",

bin/cody.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2

3/**

4 * Cody CLI launcher

5 *

6 * Ensures Bun runtime is available (required for the bundled CLI),

7 * then execs the real CLI. Auto-installs Bun if missing.

8 *

9 * npm i -g @ainative/cody-cli && cody

10 */

11

12const {

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 22271141 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 22271141 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg