Loading npm security reports…

@ainative/cody-cli@0.12.24: AI-agent control-surface risk | LPM Firewall

registry / @ainative/cody-cli / 0.12.24

@ainative/cody-cli@0.12.24

AI-powered terminal coding assistant with 21+ coding models, persistent agent memory, MCP servers, and semantic code search. Hobbyist tier starting at $5/mo.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates a user-level Cody/Claude-adjacent credential store without consent. It removes files selected by competing-provider endpoint strings, then provisions and installs AINative credentials used in preference to external Anthropic keys.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of @ainative/cody-cli

Impact

Destroys existing AI-agent credentials/settings and redirects the CLI to an AINative account/API key.

Mechanism

Unconsented competing-agent credential deletion and replacement during postinstall

Policy narrative

Installing the package invokes postinstall. The script scans ~/.cody and ~/.config/cody-cli, deletes credential/settings files containing Anthropic or Claude endpoint markers, clears cache, then silently requests an AINative trial account and atomically writes its key to ~/.cody/credentials.json. The bundled CLI treats sk-ant- keys as external and prefers the injected AINative credential. This is an unconsented install-time takeover of a user-level AI-agent credential/control surface.

Rationale

The lifecycle hook performs concrete, targeted destructive mutation of existing competing AI-agent configuration and replaces it with provider credentials. This meets the block boundary for unconsented postinstall foreign/broad AI-agent control-surface mutation.

Evidence

package.jsonbin/postinstall.cjsdist/cli.jsbin/cody.cjs.claude/hooks/install-hooks.sh~/.cody/credentials.json

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cody.jsView file

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs') ... L15: L16: const CLI_BUNDLE = path.join(__dirname, '..', 'dist', 'cli.js') L17: const MIN_BUN_VERSION = '1.2.0' L18: L19: const IS_WINDOWS = process.platform === 'win32' L20: ... L22: // HOME on Windows is USERPROFILE; fall back to HOME for Unix L23: const home = process.env.USERPROFILE || process.env.HOME || '' L24: const candidates = IS_WINDOWS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cody.jsView on unpkg · L11

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

High

Child Process

Package source references child process execution.

bin/cody.jsView on unpkg · L11

69if (IS_WINDOWS) { L70: // Windows: use PowerShell installer (Refs #3117) L71: execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "irm bun.sh/install.ps1 | iex"', { stdio: 'inherit' })

High

Shell

Package source references shell execution.

bin/cody.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.22 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 20110bcfc0a775e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ainative/cody-cli@0.12.22 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.22 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cody.jsView on unpkg

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cody.jsView on unpkg · L11

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 22304606 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 22304606 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.22 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 6-46json

6 "main": "dist/cli.js",

7 "bin": {

8 "cody": "bin/cody.cjs"

9 },

10 "files": [

11 "bin/",

12 "dist/cli.js",

13 ".ainative/AINATIVE.md",

14 ".ainative/README.md",

15 ".ainative/SDK_PUBLISHING_GUIDELINES.md",

16 ".claude/hooks/",

17 ".cody/hooks/",

18 ".cody/skills/",

19 ".cody/CODY.md",

20 ".cody/marketplace-skills/",

21 ".cody/mcp.json.example",

22 "cody",

23 "README.md"

24 ],

25 "scripts": {

26 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "build": "bash build.sh",

28 "start": "node dist/cli.js",

29 "postbuild": "bash postbuild.sh",

30 "test": "bun test",

31 "test:coverage": "bun test --coverage",

32 "test:e2e": "bun test tests/e2e/",

33 "prepublishOnly": "bun test && bash build.sh && bash postbuild.sh"

34 },

35 "homepage": "https://ainative.studio/cody",

36 "bugs": {

37 "url": "https://discord.gg/paipalooza"

38 },

39 "keywords": [

40 "cody",

41 "cody-cli",

42 "ainative",

43 "ai",

44 "ai-coding",

45 "ai-assistant",

46 "ai-agent",

bin/cody.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2

3/**

4 * Cody CLI launcher

5 *

6 * Ensures Bun runtime is available (required for the bundled CLI),

7 * then execs the real CLI. Auto-installs Bun if missing.

8 *

9 * npm i -g @ainative/cody-cli && cody

10 */

11

12const {

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 22304606 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 22304606 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.22 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg