@diffexai/diffex@0.2.1
Coding agent CLI with read, bash, edit, write, update_plan tools and session management
AI Security Review
scanned 3h ago · by lpm-firewall-aiEvolution defaults to enabled and automatically calls the configured model after its usage thresholds are reached, consuming provider quota without a per-run request. The source documents the feature and its controls, but the automatic spending matches the stated malicious behavior rule.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
After session operations settle, automatic evolution is evaluated; eligible work starts once the token, invocation, and cooldown thresholds are met.
Impact
Unrequested provider usage can incur cost. The feature also processes session evidence for its evolution task.
Mechanism
The CLI attaches the evolution coordinator to the session lifecycle. It sends accumulated invocation evidence through the current model runtime for background evolution.
Attack narrative
With evolution enabled by default, settled session operations trigger automatic eligibility checks. After enough accumulated usage, the package calls the current model provider to process invocation evidence, consuming provider quota without a separate request for each run. The feature is documented and can be disabled, but the default still permits this automatic spending.
AI rationale
Evolution defaults to enabled and automatically calls the configured model after its usage thresholds are reached, consuming provider quota without a per-run request. The source documents the feature and its controls, but the automatic spending matches the stated malicious behavior rule.
Evidence
dist/core/settings-manager.jsdist/core/agent-session.jsdist/main.jsdist/core/evolution-runtime.jsdist/vendor/evolution/token-estimator.jsdocs/settings.mdagentDir/evolution-workspaces/<workspace-id>/traces/agentDir/evolution-workspaces/<workspace-id>/evolution/
Decision evidence
public snapshotAI called this Malicious at 89.0% confidence as Malware with low false-positive risk.
Evidence for block
- Evolution is enabled by default when no setting is present.
- The CLI wires the evolution coordinator into the session lifecycle; settled operations can trigger automatic evolution work.
- The evolution executor uses the configured model runtime to make provider calls with evolution messages and tools.
- Automatic work becomes eligible after 400,000 reported tokens across at least three invocations, and the docs note those calls may consume provider quota.
Evidence against
- The package documents evolution as a feature and describes its thresholds, cooldown, and quota use.
- Users can disable future tracing and evolution work through the evolution setting.
- The manifest has no install lifecycle scripts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
8 flaggeddist/core/extensions/loader.jsView file
49};
L50: const require = createRequire(import.meta.url);
L51: const isTypeScriptSourceRuntime = !isBunBinary && path.extname(fileURLToPath(import.meta.url)) === ".ts";
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core/extensions/loader.jsView on unpkg · L49dist/node_modules/@diffexai/diffex-tui/native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file
•path = dist/node_modules/@diffexai/diffex-[redacted]-x64/darwin-modifiers.node
kind = native_binary
sizeBytes = 12776
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
dist/node_modules/@diffexai/diffex-tui/native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkgFindings
6 High5 Medium3 Low
HighSemantic Analysis Limiteddist/config.js#virtual:string-array:round1
HighKnown Malware Source Similaritydist/utils/shell.js
HighKnown Malware Source Similaritydist/core/resolve-config-value.js
HighKnown Malware Source Similaritydist/modes/rpc/rpc-client.js
HighKnown Malware Source Similaritydist/utils/clipboard.js
HighPrevious Version Dangerous Deltadist/node_modules/@diffexai/diffex-agent-core/dist/harness/env/nodejs.js
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/node_modules/@diffexai/diffex-tui/native/darwin/prebuilds/darwin-x64/darwin-modifiers.node
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @diffexai/diffex@0.2.1.
See all versions of @diffexai/diffex for other recorded verdicts.
- Avoid installing @diffexai/diffex@0.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.