Loading npm security reports…

@ainative/cody-cli@0.12.80: AI-agent control-surface risk | LPM Firewall

registry / @ainative/cody-cli / 0.12.80

@ainative/cody-cli@0.12.80

AI-powered terminal coding assistant with 21+ coding models, persistent agent memory, MCP servers, and semantic code search. Hobbyist tier starting at $5/mo.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, the package deletes credentials/settings selected for Anthropic/Claude endpoint markers, then provisions AINative credentials without an explicit command. Its runtime also uses Claude's config-dir override and redirects Anthropic SDK environment settings.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install; subsequent cody execution

Impact

Loss of third-party AI credentials/settings and redirection of provider authentication to AINative.

Mechanism

lifecycle credential replacement and AI-agent config takeover

Policy narrative

Installation invokes a postinstall script that identifies files containing Anthropic/Claude endpoint markers and deletes credential and settings files, clears cache, and silently requests an AINative trial key while asserting agreement to terms. It writes that key to ~/.cody/credentials.json. The bundled runtime honors CLAUDE_CONFIG_DIR and uses loaded credentials to set Anthropic-compatible environment variables, enabling provider redirection.

Rationale

This is concrete, unconsented install-time mutation of a shared/foreign AI-agent credential and configuration surface, coupled with automatic account provisioning and provider redirection. The declared launcher itself is benign, but it does not mitigate the lifecycle attack.

Evidence

package.jsonbin/postinstall.cjsdist/cli.js~/.cody/credentials.json~/.cody/oauth.json~/.cody/tokens.json~/.cody/.credentials

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cody.jsView file

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs') ... L15: L16: const CLI_BUNDLE = path.join(__dirname, '..', 'dist', 'cli.js') L17: const MIN_BUN_VERSION = '1.2.0' L18: L19: const IS_WINDOWS = process.platform === 'win32' L20: ... L22: // HOME on Windows is USERPROFILE; fall back to HOME for Unix L23: const home = process.env.USERPROFILE || process.env.HOME || '' L24: const candidates = IS_WINDOWS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cody.jsView on unpkg · L11

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

High

Child Process

Package source references child process execution.

bin/cody.jsView on unpkg · L11

69if (IS_WINDOWS) { L70: // Windows: use PowerShell installer (Refs #3117) L71: execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "irm bun.sh/install.ps1 | iex"', { stdio: 'inherit' })

High

Shell

Package source references shell execution.

bin/cody.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.79 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.79 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 20110bcfc0a775e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ainative/cody-cli@0.12.79 matchedPath = bin/cody.js matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.79 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cody.jsView on unpkg

11L12: const { execSync, spawn } = require('child_process') L13: const { existsSync } = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cody.jsView on unpkg · L11

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 21497778 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 21497778 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.79 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.79 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 6-46json

6 "main": "dist/cli.js",

7 "bin": {

8 "cody": "bin/cody.cjs"

9 },

10 "files": [

11 "bin/",

12 "dist/cli.js",

13 ".ainative/AINATIVE.md",

14 ".ainative/README.md",

15 ".ainative/SDK_PUBLISHING_GUIDELINES.md",

16 ".claude/hooks/",

17 ".cody/hooks/",

18 ".cody/skills/",

19 ".cody/CODY.md",

20 ".cody/marketplace-skills/",

21 ".cody/mcp.json.example",

22 "cody",

23 "README.md"

24 ],

25 "scripts": {

26 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "build": "bash build.sh",

28 "start": "node dist/cli.js",

29 "postbuild": "bash postbuild.sh",

30 "test": "bun test",

31 "test:coverage": "bun test --coverage",

32 "test:e2e": "bun test tests/e2e/",

33 "prepublishOnly": "bun test && bash build.sh && bash postbuild.sh"

34 },

35 "homepage": "https://ainative.studio/cody",

36 "bugs": {

37 "url": "https://discord.gg/paipalooza"

38 },

39 "keywords": [

40 "cody",

41 "cody-cli",

42 "ainative",

43 "ai",

44 "ai-coding",

45 "ai-assistant",

46 "ai-agent",

bin/cody.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2

3/**

4 * Cody CLI launcher

5 *

6 * Ensures Bun runtime is available (required for the bundled CLI),

7 * then execs the real CLI. Auto-installs Bun if missing.

8 *

9 * npm i -g @ainative/cody-cli && cody

10 */

11

12const {

.cody/hooks/gateguard.shView file

•path = .cody/hooks/gateguard.sh kind = payload_in_excluded_dir sizeBytes = 1688 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cody/hooks/gateguard.shView on unpkg

•path = .cody/hooks/gateguard.sh kind = build_helper sizeBytes = 1688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cody/hooks/gateguard.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 21497778 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 21497778 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @ainative/cody-cli@0.12.79 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGFpbmF0aXZlL2NvZHktY2xp:0.12.79 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg