Loading npm security reports…

@ainative/cody-cli@0.12.74: Malicious npm security report (Block) | LPM Firewall

registry / @ainative/cody-cli / 0.12.74

@ainative/cody-cli@0.12.74

AI-powered terminal coding assistant with 21+ coding models, persistent agent memory, MCP servers, and semantic code search. Hobbyist tier starting at $5/mo.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Installation automatically alters user AI-tool configuration and provisions a vendor account without an explicit command. It removes stored credentials or settings containing competing-service markers, then stores a vendor-issued key.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs when the package is installed.

Impact

Existing AI-service configuration can be deleted and the user's CLI is configured with a vendor-created account without consent.

Mechanism

The lifecycle script scans ~/.cody and ~/.config/cody-cli, deletes matching credential/settings files, POSTs to the AINative API with agreement asserted, and writes the returned key to ~/.cody/credentials.json.

Attack narrative

Installing the package invokes bin/postinstall.cjs. The script identifies credential and settings files in user configuration directories by Anthropic or Claude markers and deletes them. It then creates an AINative trial account while asserting agreement to terms and persists the returned API key in ~/.cody/credentials.json. This is unconsented install-time mutation of an AI-agent control surface combined with destructive removal of competing-service configuration.

AI rationale

The automatic lifecycle hook performs destructive credential/configuration changes and account provisioning outside an explicit user command. This is concrete install-hook abuse, not ordinary runtime setup.

Evidence

package.jsonbin/postinstall.cjs~/.cody/credentials.json~/.cody/settings.json~/.cody/cache~/.config/cody-cli

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cody.jsView file

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs') ... L15: L16: const CLI_BUNDLE = path.join(__dirname, '..', 'dist', 'cli.js') L17: const MIN_BUN_VERSION = '1.2.0' L18: L19: const IS_WINDOWS = process.platform === 'win32' L20: ... L22: // HOME on Windows is USERPROFILE; fall back to HOME for Unix L23: const home = process.env.USERPROFILE || process.env.HOME || '' L24: const candidates = IS_WINDOWS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cody.jsView on unpkg · L11

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

High

Child Process

Package source references child process execution.

bin/cody.jsView on unpkg · L11

69if (IS_WINDOWS) { L70: // Windows: use PowerShell installer (Refs #3117) L71: execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "irm bun.sh/install.ps1 | iex"', { stdio: 'inherit' })

High

Shell

Package source references shell execution.

bin/cody.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.85 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.85 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 20110bcfc0a775e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ainative/cody-cli@0.12.85 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.85 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cody.jsView on unpkg

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cody.jsView on unpkg · L11

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 21495379 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 21495379 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.85 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.85 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 6-46json

6 "main": "dist/cli.js",

7 "bin": {

8 "cody": "bin/cody.cjs"

9 },

10 "files": [

11 "bin/",

12 "dist/cli.js",

13 ".ainative/AINATIVE.md",

14 ".ainative/README.md",

15 ".ainative/SDK_PUBLISHING_GUIDELINES.md",

16 ".claude/hooks/",

17 ".cody/hooks/",

18 ".cody/skills/",

19 ".cody/CODY.md",

20 ".cody/marketplace-skills/",

21 ".cody/mcp.json.example",

22 "cody",

23 "README.md"

24 ],

25 "scripts": {

26 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "build": "bash build.sh",

28 "start": "node dist/cli.js",

29 "postbuild": "bash postbuild.sh",

30 "test": "bun test",

31 "test:coverage": "bun test --coverage",

32 "test:e2e": "bun test tests/e2e/",

33 "prepublishOnly": "bun test && bash build.sh && bash postbuild.sh"

34 },

35 "homepage": "https://ainative.studio/cody",

36 "bugs": {

37 "url": "https://discord.gg/paipalooza"

38 },

39 "keywords": [

40 "cody",

41 "cody-cli",

42 "ainative",

43 "ai",

44 "ai-coding",

45 "ai-assistant",

46 "ai-agent",

bin/cody.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2

3/**

4 * Cody CLI launcher

5 *

6 * Ensures Bun runtime is available (required for the bundled CLI),

7 * then execs the real CLI. Auto-installs Bun if missing.

8 *

9 * npm i -g @ainative/cody-cli && cody

10 */

11

12const {

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 21495379 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 21495379 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.85 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.85 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg