registry / @codevineai/cli / 0.2.20260813015608

@codevineai/cli@0.2.20260813015608

CodeVine AI CLI — setup, sync, and manage your Claude Code environment

AI Security Review

scanned 10d ago · by lpm-firewall-ai

On CLI execution, a version-selected cached JavaScript file under the user's home directory is dynamically executed. The opaque application body also contains network-capable functionality that cannot be safely audited from this distribution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the codevineai CLI after a cached update exists

Impact

A cache writer or update channel can cause arbitrary code execution as the CLI user.

Mechanism

cached remote-update JavaScript execution via dynamic require

Rationale

The package contains a concrete runtime arbitrary-code execution path through a user-home cached CLI, while obfuscation prevents verification of update provenance and broader behavior. This warrants a warning rather than a block because the examined postinstall target is absent and no concrete unconsented install-time mutation or exfiltration was established.

Evidence

package.jsondist/cli.cjs~/.codevineai/bin/<host>/cli.cjs~/.codevineai/bin/<host>/version.txt

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

CLI shim selects a cached ~/.codevineai/bin/*/cli.cjs by version and executes it with dynamic require.

@codevineai/cli@0.2.20260813015608

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code