registry / @codevineai/cli / 0.2.20260810205513

@codevineai/cli@0.2.20260810205513

CodeVine AI CLI — setup, sync, and manage your Claude Code environment

AI Security Review

scanned 12d ago · by lpm-firewall-ai

On CLI use, the package can fetch a replacement CLI from the configured CodeVine host, cache it, then execute it on a later invocation. The update path validates only a version string, not payload integrity.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Run the codevineai CLI after a CodeVine profile/configured host is available.

Impact

A compromised or malicious configured update host can obtain code execution as the CLI user.

Mechanism

unsigned remote CLI download followed by cached require execution

Rationale

This is a concrete remote-code-execution update vulnerability, but the inspected package does not show a malicious payload or active install-time attack. The declared postinstall target is missing and therefore does not execute.

Evidence

package.jsondist/cli.cjs~/.codevineai/bin/<host>/cli.cjs~/.codevineai/bin/<host>/version.txt

Network endpoints1

codevine.ai/app/cli/cli.cjs

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

@codevineai/cli@0.2.20260810205513

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code