Loading npm security reports…

@ainative/cody-cli@0.12.27: AI-agent control-surface risk | LPM Firewall

registry / @ainative/cody-cli / 0.12.27

@ainative/cody-cli@0.12.27

AI-powered terminal coding assistant with 21+ coding models, persistent agent memory, MCP servers, and semantic code search. Hobbyist tier starting at $5/mo.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation mutates the user's AI CLI configuration and credentials without a user command. It removes files based on Anthropic-related strings, provisions an account, and replaces credentials.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Can delete existing credentials/settings and redirect the local Cody configuration to a provisioned AINative key.

Mechanism

unconsented AI-agent credential/config cleanup and account provisioning

Policy narrative

On installation, the package scans ~/.cody and ~/.config/cody-cli, deletes credential/settings files containing Anthropic-related URLs and clears caches. If no selected environment variable or valid local credential exists, it automatically accepts terms with AINative, obtains a trial key, and writes it into ~/.cody/credentials.json. This is an unconsented install-time mutation of a broad AI CLI credential/control surface.

Rationale

The automatic lifecycle script performs destructive credential/config mutation and credential replacement in a shared AI CLI directory. Package-aligned networking does not mitigate the unconsented control-surface takeover.

Evidence

package.jsonbin/postinstall.cjs~/.cody/credentials.json~/.cody/oauth.json~/.cody/tokens.json~/.cody/.credentials~/.cody/settings.json~/.cody/cache~/.config/cody-cli/cache

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cody.jsView file

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs') ... L15: L16: const CLI_BUNDLE = path.join(__dirname, '..', 'dist', 'cli.js') L17: const MIN_BUN_VERSION = '1.2.0' L18: L19: const IS_WINDOWS = process.platform === 'win32' L20: ... L22: // HOME on Windows is USERPROFILE; fall back to HOME for Unix L23: const home = process.env.USERPROFILE || process.env.HOME || '' L24: const candidates = IS_WINDOWS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cody.jsView on unpkg · L11

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

High

Child Process

Package source references child process execution.

bin/cody.jsView on unpkg · L11

69if (IS_WINDOWS) { L70: // Windows: use PowerShell installer (Refs #3117) L71: execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "irm bun.sh/install.ps1 | iex"', { stdio: 'inherit' })

High

Shell

Package source references shell execution.

bin/cody.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.25 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 20110bcfc0a775e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ainative/cody-cli@0.12.25 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.25 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cody.jsView on unpkg

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cody.jsView on unpkg · L11

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 22305609 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 22305609 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.25 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 6-46json

6 "main": "dist/cli.js",

7 "bin": {

8 "cody": "bin/cody.cjs"

9 },

10 "files": [

11 "bin/",

12 "dist/cli.js",

13 ".ainative/AINATIVE.md",

14 ".ainative/README.md",

15 ".ainative/SDK_PUBLISHING_GUIDELINES.md",

16 ".claude/hooks/",

17 ".cody/hooks/",

18 ".cody/skills/",

19 ".cody/CODY.md",

20 ".cody/marketplace-skills/",

21 ".cody/mcp.json.example",

22 "cody",

23 "README.md"

24 ],

25 "scripts": {

26 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "build": "bash build.sh",

28 "start": "node dist/cli.js",

29 "postbuild": "bash postbuild.sh",

30 "test": "bun test",

31 "test:coverage": "bun test --coverage",

32 "test:e2e": "bun test tests/e2e/",

33 "prepublishOnly": "bun test && bash build.sh && bash postbuild.sh"

34 },

35 "homepage": "https://ainative.studio/cody",

36 "bugs": {

37 "url": "https://discord.gg/paipalooza"

38 },

39 "keywords": [

40 "cody",

41 "cody-cli",

42 "ainative",

43 "ai",

44 "ai-coding",

45 "ai-assistant",

46 "ai-agent",

bin/cody.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2

3/**

4 * Cody CLI launcher

5 *

6 * Ensures Bun runtime is available (required for the bundled CLI),

7 * then execs the real CLI. Auto-installs Bun if missing.

8 *

9 * npm i -g @ainative/cody-cli && cody

10 */

11

12const {

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 22305609 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 22305609 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.25 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg