@cybedefend/vibedefend@1.3.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@cybedefend/vibedefend@1.3.0: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged

dist/clients/codex.jsView file

Lines 7-47javascript

7 * use elsewhere and avoids needing a TOML AST writer).

8 * 2. Auto-enable the `codex_hooks` feature flag in `~/.codex/config.toml`

9 * (per decision 3 = A: silently flip the flag rather than printing a

10 * "edit this file manually" message).

11 *

12 * Feature-flag handling is intentionally conservative. We:

13 * - Read `config.toml` as text.

14 * - If `codex_hooks = true` already appears, leave the file alone.

15 * - If `[features]` section exists but `codex_hooks` is `false` or

16 * missing, append the line under that section.

17 * - If `[features]` doesn't exist, append a fresh `\n[features]\n

18 * codex_hooks = true\n` block at the end.

19 *

20 * Yes, this is regex-based and not a real TOML parser. Reason: a full

21 * TOML rewriter (e.g. `@iarna/toml`) strips comments + reorders keys,

22 * which is hostile to a config file the user may also edit. Appending

23 * is safer than rewriting. Doc-tested against the shapes Codex actually

24 * ships with.

25 *

26 * Tool matcher uses Codex's regex syntax (per its docs) — `^(Edit|Write|apply_patch)$`.

27 */

28import { execFileSync } from 'node:child_process';

29import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/clients/codex.jsView on unpkg · L27

30import { dirname } from 'node:path';

31import { home, log, readJson, writeJson, which } from '../utils.js';

32import { hookCommand, VIBEDEFEND_PATH_MARKER, isVibedefendOwnedHookCommand, } from '../hooks/install.js';

33import { configDirExists, probeBinaryVersion, } from './detect.js';

34const CODEX_HOOKS = home('.codex', 'hooks.json');

35const CODEX_CONFIG_TOML = home('.codex', 'config.toml');

36function detect() {

37 const version = probeBinaryVersion('codex') ?? undefined;

38 const hasConfigDir = configDirExists(home('.codex'));

39 const installed = version !== undefined || hasConfigDir;

40 if (!installed) {

41 return {

42 installed: false,

43 supportsHooks: false,

44 reason: '`codex` CLI not on PATH and no ~/.codex/ directory.',

45 };

46 }

47 return {

dist/hooks/runtime/resolve.jsView file

Lines 1-32javascript

1/**

2 * Resolve the project ID + bearer token at hook-invocation time.

3 *

4 * Both are needed for every API call. Lookup order matches the bash

5 * hooks we replaced, so existing users keep the same behaviour:

6 *

7 * projectId: $CYBEDEFEND_PROJECT_ID → .cybedefend/config.json:projectId

8 * token: $CYBEDEFEND_TOKEN → OS keychain (macOS Keychain /

9 * Linux libsecret) for the MCP

10 * server name we were installed

dist/hook-runner.jsView file

Lines 964-1004javascript

964 return ret;

965 }

966 var awaitingDependencies = {};

967 var registeredTypes = {};

968 var typeDependencies = {};

969 var

bin/vibedefend.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2// Thin shim — calls the compiled dist or runs from src in dev. Published

3// builds ship `dist/index.js`; local `pnpm dev` uses tsx via the package's

4// `dev` script.

5import { fileURLToPath } from 'node:url';

6import { dirname, join } from 'node:path';

7import { existsSync }

dist/hooks/runtime/self-update-check.jsView file

Lines 1-31javascript

1/**

2 * Throttled, opt-out background self-update check. Runs once per session

3 * from the SessionStart hook. RETURNS a one-line notice to fold into the

4 * bootstrap body (or null) — it never writes to stdout itself (the caller

5 * emits once, so Codex's JSON envelope stays intact). Side effects: writes

6 * the throttle stamp and, when an update is due + enabled for a global

7 * install, spawns a DETACHED wrapper that runs the package-manager update

8 * and records the outcome to last-update.log.

9 *

10