Loading npm security reports…

@su-record/vibe@3.1.0: AI-agent policy block | LPM Firewall

registry / @su-record/vibe / 3.1.0

@su-record/vibe@3.1.0

AI Coding Framework for Claude Code — 10+ agents, 59 skills, multi-LLM orchestration

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code modifies AI agent control surfaces outside the package. It installs global instructions, skills, hooks, and Codex notify automation that can later run package hook scripts during agent lifecycle events.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install postinstall; later Codex/Claude/Cursor agent lifecycle events

Impact

User agent behavior can be altered globally; later turn-complete automation can run git auto-commit/devlog scripts in projects.

Mechanism

unconsented AI-agent config and lifecycle hook mutation

Policy narrative

On install, the package runs a postinstall orchestrator that copies itself and hook scripts into a global vibe directory, writes global Claude/Codex instruction files, installs skills/agents into AI CLI config directories, and registers a Codex notify hook. When Codex later emits an agent-turn-complete event, the registered notify script launches package-supplied auto-commit and devlog scripts. This is unconsented lifecycle mutation of AI-agent control surfaces during package installation.

Rationale

The risky behavior is not just a CLI feature: it is activated by npm postinstall and writes persistent global agent instructions/hooks, including Codex notify automation. That matches concrete unconsented AI-agent control-surface mutation even without observed credential exfiltration. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsondist/cli/postinstall/main.jsdist/cli/postinstall/fs-utils.jsdist/cli/postinstall/global-config.jsdist/cli/setup/ProjectSetup.js

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/lib/llm-availability.jsView file

6*/ L7: import { execSync } from 'child_process'; L8: import path from 'path';

High

Child Process

Package source references child process execution.

dist/infra/lib/llm-availability.jsView on unpkg · L6

dist/infra/lib/PythonParser.jsView file

8import os from 'os'; L9: const execAsync = promisify(exec); L10: // Determine Python command based on platform

High

Shell

Package source references shell execution.

dist/infra/lib/PythonParser.jsView on unpkg · L8

dist/tools/convention/applyQualityRules.jsView file

21react: ['dangerouslySetInnerHTML', 'props drilling (3+ levels)'], L22: javascript: ['var usage', '== instead of ===', 'eval() usage'], L23: css: ['!important abuse', 'inline style abuse']

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/convention/applyQualityRules.jsView on unpkg · L21

dist/infra/lib/MemoryManager.jsView file

33try { L34: const fs = require('fs'); L35: if (fs.existsSync(cwdClaudePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/lib/MemoryManager.jsView on unpkg · L33

dist/cli/commands/codex-proxy.jsView file

33console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (data.models || []).map(m => m.slug).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

dist/infra/lib/codex-proxy.jsView file

912const settings = getProxySettings(); L913: const defaultModel = model || process.env.CODEX_PROXY_MODEL || resolveDefaultModel(settings.model); L914: const modelSlots = resolveModelSlots(defaultModel); ... L921: console.log(`Codex Proxy :${port} | ${authLabel} | opus=${modelSlots.opus} sonnet=${modelSlots.sonnet} haiku=${modelSlots.haiku}`); L922: const child = spawn('claude', ['--dangerously-sk[redacted]', ...claudeArgs], { L923: stdio: 'inherit', ... L925: ...process.env, L926: ANTHROPIC_BASE_URL: `http://localhost:${port}`, L927: ANTHROPIC_AUTH_TOKEN: 'codex-proxy',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/infra/lib/codex-proxy.jsView on unpkg · L912

dist/cli/setup/GlobalInstaller.jsView file

55else { L56: execSync(`npm install @su-record/vibe@${currentVersion} --prefix "${globalCoreDir}" --no-save`, { L57: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/setup/GlobalInstaller.jsView on unpkg · L55

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

hooks/scripts/clone-extract.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @su-record/vibe@3.0.0 matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.0.0 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

hooks/scripts/clone-extract.jsView on unpkg

skills/e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/e2e-commerce/templates/test-scenarios.md

skills/e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121

Source & flagged code

13 flagged

package.jsonView file

Lines 15-55json

15 "./memory": {

16 "types": "./dist/infra/lib/memory/index.d.ts",

17 "default": "./dist/infra/lib/memory/index.js"

18 }

19 },

20 "bin": {

21 "vibe": "dist/cli/index.js"

22 },

23 "scripts": {

24 "build": "tsc && chmod +x dist/cli/index.js",

25 "dev": "tsc --watch",

26 "gen:skill-docs": "npx tsx scripts/gen-skill-docs.ts",

27 "gen:skill-docs:check": "npx tsx scripts/gen-skill-docs.ts --check",

28 "sync:agent-models": "npx tsx scripts/sync-agent-models.ts",

29 "sync:agent-models:check": "npx tsx scripts/sync-agent-models.ts --check",

30 "validate:skill-invocation": "npx tsx scripts/validate-skill-invocation.ts",

31 "validate:counts": "npx tsx scripts/validate-counts.ts",

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "prepublishOnly": "pnpm build",

35 "postinstall": "node -e \"import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L35

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "release": "pnpm version patch && git push origin main --follow-tags"

37 },

38 "keywords": [

39 "ai",

40 "core",

41 "coding",

42 "spec-driven",

43 "claude",

44 "agent",

45 "requirements",

46 "user-story",

47 "ultrawork",

48 "parallel-agents",

49 "memory-management",

50 "knowledge-graph",

51 "code-analysis",

52 "code-quality",

53 "harness"

54 ],

55 "author": "Su",

dist/infra/lib/llm-availability.jsView file

Lines 1-26javascript

1/**

2 * LLM 가용성 감지 유틸

3 *

4 * Claude/Codex/Antigravity CLI 활성화 여부를 런타임에 판단.

5 * 결과는 프로세스당 1회 캐시.

6 */

7import { execSync } from 'child_process';

8import path from 'path'

dist/infra/lib/PythonParser.jsView file

Lines 1-28javascript

1// Python code parser utility for v1.3

2// Uses Python's ast module via child_process

3import { exec } from 'child_process';

4import { promisify } from 'util';

5import { writeFile, unlink } from 'fs/promises';

6

dist/tools/convention/applyQualityRules.jsView file

Lines 1-41javascript

1// Convention management tool - completely independent

2// Code Quality Standards

3const QUALITY_RULES = {

4 NAMING: {

5 variables: 'nouns (userList, userData)',

6 functions: 'verb+noun (fetchData, updateUser)',

7 events: 'handle prefix (handleClick, handleSubmit)'

dist/infra/lib/MemoryManager.jsView file

Lines 13-53javascript

13 storage;

14 graph;

15 memorySearch;

16 observations;

17 sessionRAG;

18 ragRetriever;

19 reflections;

20 // Map of projectPath -> MemoryManager instance (for project-based memory)

21 static instances = new Map

dist/cli/commands/codex-proxy.jsView file

Lines 13-53javascript

13 'codex-cli': 'Codex CLI (ChatGPT Pro)',

14 'apikey': 'API Key',

15 'env': 'CODEX_PROXY_API_KEY',

16};

17// ─── 실행 ────────────────────────────────────────────────────

18export function

dist/infra/lib/codex-proxy.jsView file

Lines 892-932javascript

892 // Sonnet → codex 코딩 모델 (spark 제외, 정확도 우선)

893 const codexModel = models.find(m => m.includes('codex') && !m.includes('mini'

dist/cli/setup/GlobalInstaller.jsView file

55else { L56: execSync(`npm install @su-record/vibe@${currentVersion} --prefix "${globalCoreDir}" --no-save`, { L57: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/setup/GlobalInstaller.jsView on unpkg · L55

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

hooks/scripts/clone-extract.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @su-record/vibe@3.0.0 matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.0.0 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

hooks/scripts/clone-extract.jsView on unpkg

skills/e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/e2e-commerce/templates/test-scenarios.md

skills/e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121