registry / @pellux/goodvibes-tui / 2.0.21

@pellux/goodvibes-tui@2.0.21

Terminal-native GoodVibes client for coding, operations, knowledge and channel workflows; a pure client of the GoodVibes daemon.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The postinstall hook makes a global agent-instruction change, so this warrants a warning for agent extension lifecycle risk. The inspected source does not establish a block-level attack.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The package’s postinstall hook runs during installation, and the global instruction file does not already exist.

Impact

Future GoodVibes agent behavior may follow the added general instructions.

Mechanism

The hook copies the bundled GOODVIBES.md file to the global GoodVibes configuration directory.

AI rationale

The postinstall hook makes a global agent-instruction change, so this warrants a warning for agent extension lifecycle risk. The inspected source does not establish a block-level attack.

Evidence

package.jsonscripts/postinstall.js.goodvibes/GOODVIBES.mdsrc/core/stream-event-wiring.ts

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js automatically after installation.
The hook copies the package’s GOODVIBES.md into the user’s global GoodVibes instructions file when that file is absent.
The copied instructions add general rules for agent planning and execution, creating an install-time agent configuration change.
The flagged stream-event operation looks up model pricing; the inspected excerpt shows no account action.

Evidence against

The global instruction file is only copied when it does not already exist; the inspected source does not establish credential transfer or remote code execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 564 file(s), 5.14 MB of source, external domains: 127.0.0.1, 192.168.0.85, api.github.com, astral.sh, bluebubbles.local, bun.sh, cloud.debian.org, daemon.example.com, deno.land, example.com, github.com, goodvibes-batch-worker.account.workers.dev, goodvibes.sh, homeassistant.local, imessage-bridge.local, install.duckdb.org, matrix.example.com, mattermost.example.com, ntfy.sh, signal-bridge.local, smba.trafficmanager.net, telephony-bridge.example.test, workshop.local

Source & flagged code

10 flagged

package.jsonView file

Lines 23-64json

23 "docs/foundation-artifacts"

24 ],

25 "scripts": {

26 "dev": "bun run src/main.ts",

27 "dev:watch": "bun --watch src/main.ts",

28 "prebuild": "bun run scripts/prebuild.ts",

29 "build": "bun build src/main.ts --compile --outfile dist/goodvibes",

30 "build:linux-x64": "goodvibes-build-binaries --target linux-x64",

31 "build:linux-arm64": "goodvibes-build-binaries --target linux-arm64",

32 "build:macos-x64": "goodvibes-build-binaries --target darwin-x64",

33 "build:macos-arm64": "goodvibes-build-binaries --target darwin-arm64",

34 "smoke:tui": "goodvibes-post-build-smoke",

35 "build:windows": "goodvibes-build-binaries --target windows-x64",

36 "build:all-shell": "bun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows",

37 "typecheck": "bunx tsc --noEmit",

38 "typecheck:test": "bunx tsc --noEmit -p tsconfig.test.json",

39 "typecheck:coverage": "bun run scripts/typecheck-coverage-rule.ts",

40 "test": "bun run scripts/run-tests.ts",

41 "test:coverage": "bun run scripts/coverage-gate.ts",

42 "version": "bun run scripts/prebuild.ts",

43 "preinstall": "sh scripts/check-bun.sh",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "postinstall": "bun scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "postbuild": "bun scripts/postinstall.js --no-download",

46 "release": "bun run scripts/release.ts",

47 "release:dry": "bun run scripts/release.ts --dry-run",

48 "publish:package": "bun run scripts/publish-package.ts",

49 "publish:dry-run": "bun run scripts/publish-package.ts --dry-run",

50 "platform:assemble": "bun run scripts/assemble-platform-packages.ts",

51 "platform:publish": "bun run scripts/publish-platform-packages.ts",

52 "platform:publish:dry-run": "bun run scripts/publish-platform-packages.ts --dry-run",

53 "publish:dry-run:github": "GOODVIBES_PUBLIC_PACKAGE_NAME=@mgd34msu/goodvibes-tui GOODVIBES_PUBLISH_REGISTRY=https://npm.pkg.github.com bun run scripts/publish-package.ts --dry-run",

54 "publish:check": "bun run scripts/publish-check.ts",

55 "verify:tag-version": "bun run scripts/verify-release-tag-version.ts",

56 "package:install-check": "bun run scripts/package-install-check.ts",

57 "build:prod": "goodvibes-build-binaries",

58 "build:all": "goodvibes-build-binaries --all",

59 "perf:check": "bun run scripts/perf-check.ts",

60 "perf:baseline": "GOODVIBES_PERF_SAVE_BASELINE=1 bun run scripts/perf-check.ts",

61 "architecture:check": "bun run scripts/check-architecture.ts",

62 "workflows:check": "bun run scripts/check-workflows.ts",

63 "audit:home": "bun run scripts/audit-goodvibes-home.ts",

64 "foundation:artifacts": "bun run scripts/export-foundation-artifacts.ts",

bin/launcher-support.jsView file

Lines 1-23javascript

1import { accessSync, chmodSync, constants, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

2import { createHash } from 'node:crypto';

3import { createRequire } from 'node:module';

4import { spawnSync } from 'node:child_process'

src/runtime/sandbox-public-gaps.tsView file

Lines 1-22typescript

1import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

2import { dirname, resolve } from 'node:path';

3import { spawnSync } from 'node:child_process';

4import {

Critical

Persistence Backdoor

src/verification/live-verifier.tsView file

Lines 69-109typescript

69 }

70 } catch {

71 return undefined;

72 }

73 return undefined;

74}

76function

scripts/check-bun.shView file

•path = scripts/check-bun.sh kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-bun.shView on unpkg

src/cli/plugin-bundles-command.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/cli/plugin-bundles-command.ts#virtual:normalized:round1View on unpkg

src/audio/player.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pellux/goodvibes-tui@2.0.20 matchedIdentity = npm:QHBlbGx1eC9nb29kdmliZXMtdHVp:2.0.20 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/audio/player.tsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bun scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = sh scripts/check-bun.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/launcher-support.jsView file

Findings

2 Critical5 High7 Medium4 Low

CriticalPersistence Backdoorsrc/runtime/sandbox-public-gaps.ts

CriticalPrevious Version Dangerous Deltasrc/audio/player.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/launcher-support.js

HighShell

HighSame File Env Network Executionsrc/verification/live-verifier.ts

HighSemantic Analysis Limitedsrc/cli/plugin-bundles-command.ts#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/runtime/sandbox-public-gaps.ts

Affected versions and remediation

This report applies to @pellux/goodvibes-tui@2.0.21.

See all versions of @pellux/goodvibes-tui for other recorded verdicts.

Review the evidence and your use of @pellux/goodvibes-tui@2.0.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 01:05:56.488Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.