registry / @codevineai/cli / 0.2.20261005221724

@codevineai/cli@0.2.20261005221724

CodeVine AI CLI — setup, sync, and manage your Claude Code environment

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No concrete attack was identified. The obfuscated CLI can automatically execute a newer cached CodeVine CLI, but the inspected source does not establish that this cached executable is attacker-controlled.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the CLI when a newer cached version exists.

Impact

An unsafe cached executable could run with the user’s privileges; the inspected source does not show an untrusted source for that file.

Mechanism

The launcher requires the cached executable from the user’s CodeVine directory and skips its own bundled code after that load.

AI rationale

The obfuscated bundle and automatic cached-code execution leave real but unresolved code-loading risk, while the inspected source does not prove a concrete attack or malicious payload. The absent postinstall target does not establish install-time mutation.

Evidence

dist/cli.cjs~/.codevineai/bin/<host>/cli.cjs

Decision evidence

public snapshot

AI called this Suspicious at 69.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The distributed CLI bundle is heavily obfuscated, limiting verification of its behavior.
The CLI automatically loads a newer cached executable from the user’s CodeVine directory.

@codevineai/cli@0.2.20261005221724

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code