registry / @codevineai/cli / 0.2.20260727143255

@codevineai/cli@0.2.20260727143255

CodeVine AI CLI — setup, sync, and manage your Claude Code environment

AI Security Review

scanned 26d ago · by lpm-firewall-ai

On CLI execution, the package can download and persist a newer remote CLI, then execute it on later runs. Its explicit setup/install commands configure CodeVine integrations in Claude-related settings.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the codevineai CLI; setup/install commands for agent configuration.

Impact

A server-controlled cached update can gain the CLI user's code-execution privileges; explicit commands can alter configured agent behavior.

Mechanism

unsigned remote CLI update cache and explicit agent integration setup

Rationale

The missing postinstall target means installation itself has no confirmed effect, but the unsigned remote-code update path is a concrete high-risk execution mechanism. Agent configuration writes are explicit user-command functionality rather than unconsented lifecycle mutation.

Evidence

package.jsondist/cli.cjs~/.codevineai/bin/<host>/cli.cjs~/.codevineai/bin/<host>/version.txt~/.codevineai/credentials~/.claude.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

@codevineai/cli@0.2.20260727143255

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code