registry / @pellux/goodvibes-tui / 2.1.0

@pellux/goodvibes-tui@2.1.0

⚠ Under review

Terminal-native GoodVibes client for coding, operations, knowledge and channel workflows; a pure client of the GoodVibes daemon.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Inspected source facts explain the flagged lifecycle and runtime behaviors without establishing an attack. A clean result cannot be fully supported because the required clean-source citations exceed the limit; the inspected behavior does not independently justify a warning or block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Package installation, explicit QEMU setup, or an explicit session-share command, depending on the feature.

Impact

No malicious effect was established from the inspected behavior.

Mechanism

The install hook verifies a release binary and deploys GoodVibes-scoped files; QEMU scaffolding runs through a product command; Gist upload requires an explicit option.

AI rationale

Decision evidence

public snapshot

AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest runs a Bun availability check before install and a postinstall setup script.
The postinstall script checks a downloaded binary against its release checksum before installing it.
The postinstall script copies bundled skills and agents into GoodVibes-specific home directories.
QEMU setup is invoked through a product command and writes a guest configuration with passwordless sudo.
Session export uploads only when the user supplies the --upload option, and sends the token to GitHub's Gist API.
The inspected sources do not establish a concrete attack; clean review requires 258 citations, exceeding the 128-citation limit.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

10 flagged

package.jsonView file

Lines 23-64json

23 "docs/foundation-artifacts"

24 ],

25 "scripts": {

26 "dev": "bun run src/main.ts",

27 "dev:watch": "bun --watch src/main.ts",

28 "prebuild": "bun run scripts/prebuild.ts",

29 "build": "bun build src/main.ts --compile --outfile dist/goodvibes",

30 "build:linux-x64": "goodvibes-build-binaries --target linux-x64",

31 "build:linux-arm64": "goodvibes-build-binaries --target linux-arm64",

32 "build:macos-x64": "goodvibes-build-binaries --target darwin-x64",

33 "build:macos-arm64": "goodvibes-build-binaries --target darwin-arm64",

34 "smoke:tui": "goodvibes-post-build-smoke",

35 "build:windows": "goodvibes-build-binaries --target windows-x64",

36 "build:all-shell": "bun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows",

37 "typecheck": "bunx tsc --noEmit",

38 "typecheck:test": "bunx tsc --noEmit -p tsconfig.test.json",

39 "typecheck:coverage": "bun run scripts/typecheck-coverage-rule.ts",

40 "test": "bun run scripts/run-tests.ts",

41 "test:coverage": "bun run scripts/coverage-gate.ts",

42 "version": "bun run scripts/prebuild.ts",

43 "preinstall": "sh scripts/check-bun.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "postinstall": "bun scripts/postinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "postbuild": "bun scripts/postinstall.js --no-download",

46 "release": "bun run scripts/release.ts",

47 "release:dry": "bun run scripts/release.ts --dry-run",

48 "publish:package": "bun run scripts/publish-package.ts",

49 "publish:dry-run": "bun run scripts/publish-package.ts --dry-run",

50 "platform:assemble": "bun run scripts/assemble-platform-packages.ts",

51 "platform:publish": "bun run scripts/publish-platform-packages.ts",

52 "platform:publish:dry-run": "bun run scripts/publish-platform-packages.ts --dry-run",

53 "publish:dry-run:github": "GOODVIBES_PUBLIC_PACKAGE_NAME=@mgd34msu/goodvibes-tui GOODVIBES_PUBLISH_REGISTRY=https://npm.pkg.github.com bun run scripts/publish-package.ts --dry-run",

54 "publish:check": "bun run scripts/publish-check.ts",

55 "verify:tag-version": "bun run scripts/verify-release-tag-version.ts",

56 "package:install-check": "bun run scripts/package-install-check.ts",

57 "build:prod": "goodvibes-build-binaries",

58 "build:all": "goodvibes-build-binaries --all",

59 "perf:check": "bun run scripts/perf-check.ts",

60 "perf:baseline": "GOODVIBES_PERF_SAVE_BASELINE=1 bun run scripts/perf-check.ts",

61 "architecture:check": "bun run scripts/check-architecture.ts",

62 "workflows:check": "bun run scripts/check-workflows.ts",

63 "audit:home": "bun run scripts/audit-goodvibes-home.ts",

64 "foundation:artifacts": "bun run scripts/export-foundation-artifacts.ts",

bin/launcher-support.jsView file

Lines 1-23javascript

1import { accessSync, chmodSync, constants, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

2import { createHash } from 'node:crypto';

3import { createRequire } from 'node:module';

4import { spawnSync } from 'node:child_process'

src/runtime/sandbox-public-gaps.tsView file

Lines 1-22typescript

1import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

2import { dirname, resolve } from 'node:path';

3import { spawnSync } from 'node:child_process';

4import {

Critical

Persistence Backdoor

src/verification/live-verifier.tsView file

Lines 69-109typescript

69 }

70 } catch {

71 return undefined;

72 }

73 return undefined;

74}

76function

scripts/check-bun.shView file

•path = scripts/check-bun.sh kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-bun.shView on unpkg

src/cli/plugin-bundles-command.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/cli/plugin-bundles-command.ts#virtual:normalized:round1View on unpkg

src/audio/player.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pellux/goodvibes-tui@2.0.20 matchedIdentity = npm:QHBlbGx1eC9nb29kdmliZXMtdHVp:2.0.20 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/audio/player.tsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = sh scripts/check-bun.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = sh scripts/check-bun.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/launcher-support.jsView file

Findings

2 Critical5 High7 Medium4 Low

CriticalPersistence Backdoorsrc/runtime/sandbox-public-gaps.ts

CriticalPrevious Version Dangerous Deltasrc/audio/player.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/launcher-support.js

HighShell

HighSame File Env Network Executionsrc/verification/live-verifier.ts

HighSemantic Analysis Limitedsrc/cli/plugin-bundles-command.ts#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/runtime/sandbox-public-gaps.ts

Affected versions and remediation

This report applies to @pellux/goodvibes-tui@2.1.0.

See all versions of @pellux/goodvibes-tui for other recorded verdicts.

Review the evidence and your use of @pellux/goodvibes-tui@2.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 01:07:10.945Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.