@su-record/vibe: AI-agent policy block

Loading npm security reports…

Source & flagged code

17 flagged

package.jsonView file

Lines 15-55json

15 "./memory": {

16 "types": "./dist/infra/lib/memory/index.d.ts",

17 "default": "./dist/infra/lib/memory/index.js"

18 }

19 },

20 "bin": {

21 "vibe": "dist/cli/index.js"

22 },

23 "scripts": {

24 "build": "tsc && chmod +x dist/cli/index.js",

25 "dev": "tsc --watch",

26 "gen:skill-docs": "npx tsx scripts/gen-skill-docs.ts",

27 "gen:skill-docs:check": "npx tsx scripts/gen-skill-docs.ts --check",

28 "sync:agent-models": "npx tsx scripts/sync-agent-models.ts",

29 "sync:agent-models:check": "npx tsx scripts/sync-agent-models.ts --check",

30 "validate:skill-invocation": "npx tsx scripts/validate-skill-invocation.ts",

31 "validate:counts": "npx tsx scripts/validate-counts.ts",

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "prepublishOnly": "pnpm build",

35 "postinstall": "node -e \"import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L35

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "release": "pnpm version patch && git push origin main --follow-tags"

37 },

38 "keywords": [

39 "ai",

40 "core",

41 "coding",

42 "spec-driven",

43 "claude",

44 "agent",

45 "requirements",

46 "user-story",

47 "ultrawork",

48 "parallel-agents",

49 "memory-management",

50 "knowledge-graph",

51 "code-analysis",

52 "code-quality",

53 "harness"

54 ],

55 "author": "Su",

dist/infra/lib/TaskContext.jsView file

Lines 6-46javascript

6// ============================================================================

7// TaskContext (static registry)

8// ============================================================================

9export class TaskContext {

10 static registry = new Map();

dist/infra/lib/PythonParser.jsView file

Lines 1-28javascript

1// Python code parser utility for v1.3

2// Uses Python's ast module via child_process

3import { exec } from 'child_process';

4import { promisify } from 'util';

5import { writeFile, unlink } from 'fs/promises';

dist/tools/convention/applyQualityRules.jsView file

Lines 1-41javascript

1// Convention management tool - completely independent

2// Code Quality Standards

3const QUALITY_RULES = {

4 NAMING: {

5 variables: 'nouns (userList, userData)',

6 functions: 'verb+noun (fetchData, updateUser)',

7 events: 'handle prefix (handleClick, handleSubmit)'

dist/infra/lib/MemoryManager.jsView file

Lines 13-53javascript

13 storage;

14 graph;

15 memorySearch;

16 observations;

17 sessionRAG;

18 ragRetriever;

19 reflections;

20 // Map of projectPath -> MemoryManager instance (for project-based memory)

21 static instances = new Map

dist/cli/commands/codex-proxy.jsView file

Lines 13-53javascript

13 'codex-cli': 'Codex CLI (ChatGPT Pro)',

14 'apikey': 'API Key',

15 'env': 'CODEX_PROXY_API_KEY',

16};

17// ─── 실행 ────────────────────────────────────────────────────

18export function

dist/infra/lib/codex-proxy.jsView file

Lines 892-932javascript

892 // Sonnet → codex 코딩 모델 (spark 제외, 정확도 우선)

893 const codexModel = models.find(m => m.includes('codex') && !m.includes('mini'

dist/cli/commands/telegram.jsView file

100try { L101: child_process.execSync('npm install playwright', { L102: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/telegram.jsView on unpkg · L100

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.3 matchedPath = dist/cli/commands/telegram.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/telegram.jsView on unpkg

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

hooks/scripts/llm-orchestrate.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.3 matchedPath = hooks/scripts/llm-orchestrate.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/llm-orchestrate.jsView on unpkg

dist/cli/commands/init.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.3 matchedPath = dist/cli/commands/init.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/init.jsView on unpkg

dist/cli/commands/update.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.3 matchedPath = dist/cli/commands/update.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/update.jsView on unpkg

skills/vibe.e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/vibe.e2e-commerce/templates/test-scenarios.md

skills/vibe.e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/lib/TaskContext.jsView file

26} L27: static fork(parentContext, forkOpts) { L28: const data = {

High

Child Process

Package source references child process execution.

dist/infra/lib/TaskContext.jsView on unpkg · L26

@su-record/vibe: AI-agent policy block | LPM Firewall

Source & flagged code

17 flagged

package.jsonView file

Lines 15-55json

15 "./memory": {

16 "types": "./dist/infra/lib/memory/index.d.ts",

17 "default": "./dist/infra/lib/memory/index.js"

18 }

19 },

20 "bin": {

21 "vibe": "dist/cli/index.js"

22 },

23 "scripts": {

24 "build": "tsc && chmod +x dist/cli/index.js",

25 "dev": "tsc --watch",

26 "gen:skill-docs": "npx tsx scripts/gen-skill-docs.ts",

27 "gen:skill-docs:check": "npx tsx scripts/gen-skill-docs.ts --check",

28 "sync:agent-models": "npx tsx scripts/sync-agent-models.ts",

29 "sync:agent-models:check": "npx tsx scripts/sync-agent-models.ts --check",

30 "validate:skill-invocation": "npx tsx scripts/validate-skill-invocation.ts",

31 "validate:counts": "npx tsx scripts/validate-counts.ts",

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "prepublishOnly": "pnpm build",

35 "postinstall": "node -e \"import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L35

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "release": "pnpm version patch && git push origin main --follow-tags"

37 },

38 "keywords": [

39 "ai",

40 "core",

41 "coding",

42 "spec-driven",

43 "claude",

44 "agent",

45 "requirements",

46 "user-story",

47 "ultrawork",

48 "parallel-agents",

49 "memory-management",

50 "knowledge-graph",

51 "code-analysis",

52 "code-quality",

53 "harness"

54 ],

55 "author": "Su",

dist/infra/lib/TaskContext.jsView file

Lines 6-46javascript

6// ============================================================================

7// TaskContext (static registry)

8// ============================================================================

9export class TaskContext {

10 static registry = new Map();

dist/infra/lib/PythonParser.jsView file

Lines 1-28javascript

1// Python code parser utility for v1.3

2// Uses Python's ast module via child_process

3import { exec } from 'child_process';

4import { promisify } from 'util';

5import { writeFile, unlink } from 'fs/promises';

dist/tools/convention/applyQualityRules.jsView file

Lines 1-41javascript

1// Convention management tool - completely independent

2// Code Quality Standards

3const QUALITY_RULES = {

4 NAMING: {

5 variables: 'nouns (userList, userData)',

6 functions: 'verb+noun (fetchData, updateUser)',

7 events: 'handle prefix (handleClick, handleSubmit)'

dist/infra/lib/MemoryManager.jsView file

Lines 13-53javascript

13 storage;

14 graph;

15 memorySearch;

16 observations;

17 sessionRAG;

18 ragRetriever;

19 reflections;

20 // Map of projectPath -> MemoryManager instance (for project-based memory)

21 static instances = new Map

dist/cli/commands/codex-proxy.jsView file

Lines 13-53javascript

13 'codex-cli': 'Codex CLI (ChatGPT Pro)',

14 'apikey': 'API Key',

15 'env': 'CODEX_PROXY_API_KEY',

16};

17// ─── 실행 ────────────────────────────────────────────────────

18export function

dist/infra/lib/codex-proxy.jsView file

Lines 892-932javascript

892 // Sonnet → codex 코딩 모델 (spark 제외, 정확도 우선)

893 const codexModel = models.find(m => m.includes('codex') && !m.includes('mini'

dist/cli/commands/telegram.jsView file

100try { L101: child_process.execSync('npm install playwright', { L102: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/telegram.jsView on unpkg · L100

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/telegram.jsView on unpkg

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

hooks/scripts/llm-orchestrate.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/llm-orchestrate.jsView on unpkg

dist/cli/commands/init.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/init.jsView on unpkg

dist/cli/commands/update.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/update.jsView on unpkg

skills/vibe.e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/vibe.e2e-commerce/templates/test-scenarios.md

skills/vibe.e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121

@su-record/vibe@3.2.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code