Loading npm security reports…

@ainative/cody-cli@0.12.25: Malicious npm security report (Block) | LPM Firewall

registry / @ainative/cody-cli / 0.12.25

@ainative/cody-cli@0.12.25

AI-powered terminal coding assistant with 21+ coding models, persistent agent memory, MCP servers, and semantic code search. Hobbyist tier starting at $5/mo.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

npm postinstall mutates an existing per-user AI CLI configuration without user action. It deletes credentials/settings associated with competing Anthropic/Claude services, then provisions and installs AINative credentials.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install

Impact

Loss of existing AI CLI credentials/settings and unconsented account/configuration mutation.

Mechanism

silent credential deletion and replacement provisioning

Attack narrative

During npm postinstall, the package inspects ~/.cody credential and settings files, deletes them when they reference Anthropic/Claude endpoints, clears the cache, requests an AINative trial while asserting agreement to terms, and writes the returned API key into ~/.cody/credentials.json. The bundled CLI then selects that provisioned key over an external Anthropic key.

Rationale

The install-time, targeted removal of third-party AI credentials/settings plus silent replacement with a vendor account is concrete destructive and control-surface behavior. This exceeds a user-invoked migration or package-owned setup.

Evidence

package.jsonbin/postinstall.cjsdist/cli.js~/.cody/credentials.json~/.cody/oauth.json~/.cody/tokens.json~/.cody/.credentials~/.cody/settings.json~/.cody/cache

Network endpoints1

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cody.jsView file

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs') ... L15: L16: const CLI_BUNDLE = path.join(__dirname, '..', 'dist', 'cli.js') L17: const MIN_BUN_VERSION = '1.2.0' L18: L19: const IS_WINDOWS = process.platform === 'win32' L20: ... L22: // HOME on Windows is USERPROFILE; fall back to HOME for Unix L23: const home = process.env.USERPROFILE || process.env.HOME || '' L24: const candidates = IS_WINDOWS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cody.jsView on unpkg · L11

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

High

Child Process

Package source references child process execution.

bin/cody.jsView on unpkg · L11

69if (IS_WINDOWS) { L70: // Windows: use PowerShell installer (Refs #3117) L71: execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "irm bun.sh/install.ps1 | iex"', { stdio: 'inherit' })

High

Shell

Package source references shell execution.

bin/cody.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.24 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 20110bcfc0a775e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ainative/cody-cli@0.12.24 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.24 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cody.jsView on unpkg

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cody.jsView on unpkg · L11

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 22304503 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 22304503 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.24 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg