Loading npm security reports…

@su-record/vibe@3.2.27: AI-agent control-surface risk | LPM Firewall

registry / @su-record/vibe / 3.2.27

@su-record/vibe@3.2.27

AI Coding Framework for Claude Code — 7+ agents, 52 skills, multi-LLM orchestration

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates global Claude and detected Codex configuration without an explicit user command. It installs agent assets and a Codex lifecycle notify that invokes package scripts on completed agent turns.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation when lifecycle scripts run; Codex configuration is present or detected.

Impact

Package code gains recurring execution through a foreign AI-agent control surface; its hook can invoke auto-commit and devlog scripts.

Mechanism

automatic global AI-agent configuration and lifecycle-hook installation

Policy narrative

Installing the package runs postinstall automatically. The setup writes global Claude assets and, when Codex is detected, injects AGENTS.md content and a notify command into ~/.codex/config.toml. That notify executes package-owned scripts on every agent-turn-complete event, creating an unconsented persistent execution path in a broad AI-agent control surface.

Rationale

This is concrete unconsented postinstall mutation of global Claude/Codex control surfaces, including a recurring Codex notify hook. The existing-notify safeguard does not remove the unsafe default behavior when no notify is configured.

Evidence

package.jsondist/cli/postinstall/main.jsdist/cli/postinstall/claude-agents.jsdist/cli/setup/ProjectSetup.jshooks/scripts/codex-notify.js~/.claude/agents~/.claude/skills~/.claude/CLAUDE.md

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(e=>process.stderr.write('\u26a0\ufe0f vibe postinstall skipped: '+((e&&e.message)||e)+'\n Assets and ho...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(e=>process.stderr.write('\u26a0\ufe0f vibe postinstall skipped: '+((e&&e.message)||e)+'\n Assets and ho...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/lib/TaskContext.jsView file

26} L27: static fork(parentContext, forkOpts) { L28: const data = {

High

Child Process

Package source references child process execution.

dist/infra/lib/TaskContext.jsView on unpkg · L26

dist/infra/lib/PythonParser.jsView file

8import os from 'os'; L9: const execAsync = promisify(exec); L10: // Determine Python command based on platform

High

Shell

Package source references shell execution.

dist/infra/lib/PythonParser.jsView on unpkg · L8

dist/tools/convention/applyQualityRules.jsView file

21react: ['dangerouslySetInnerHTML', 'props drilling (3+ levels)'], L22: javascript: ['var usage', '== instead of ===', 'eval() usage'], L23: css: ['!important abuse', 'inline style abuse']

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/convention/applyQualityRules.jsView on unpkg · L21

dist/infra/lib/MemoryManager.jsView file

33try { L34: const fs = require('fs'); L35: if (fs.existsSync(cwdClaudePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/lib/MemoryManager.jsView on unpkg · L33

dist/cli/commands/codex-proxy.jsView file

33Trigger-reachable persistence chain: manifest.main -> dist/cli/index.js -> dist/cli/commands/codex-proxy.js L33: console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (da

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

33console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (data.models || []).map(m => m.slug).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

dist/infra/lib/codex-proxy.jsView file

912const settings = getProxySettings(); L913: const defaultModel = model || process.env.CODEX_PROXY_MODEL || resolveDefaultModel(settings.model); L914: const modelSlots = resolveModelSlots(defaultModel); ... L921: console.log(`Codex Proxy :${port} | ${authLabel} | opus=${modelSlots.opus} sonnet=${modelSlots.sonnet} haiku=${modelSlots.haiku}`); L922: const child = spawn('claude', ['--dangerously-sk[redacted]', ...claudeArgs], { L923: stdio: 'inherit', ... L925: ...process.env, L926: ANTHROPIC_BASE_URL: `http://localhost:${port}`, L927: ANTHROPIC_AUTH_TOKEN: 'codex-proxy',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/infra/lib/codex-proxy.jsView on unpkg · L912

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.26 matchedPath = dist/infra/lib/codex-proxy.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/infra/lib/codex-proxy.jsView on unpkg

hooks/scripts/llm-orchestrate.jsView file

33Source sends the broad process environment to a literal external destination. L33: import crypto from 'crypto'; L34: import { execSync, spawn } from 'child_process'; L35: ... L46: // 낮춰 부모 dispatcher timeout 안에 단일 시도로 끝낸다. (B-2: hard-kill/무음실패 방지) L47: const MAX_RETRIES = Number(process.env.VIBE_LLM_MAX_RETRIES) || 3; L48: // WHY 2000ms initial delay: LLM rate-limit windows are typically 1-5s; ... L215: function spawnCli(cmd, args, options) { L216: // Windows: .cmd shim은 spawn 직접 실행 불가 → cmd.exe /c 로 실행 L217: if (IS_WINDOWS) { ... L251: }); L252: proc.stdin.end(fullPrompt); L253:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

hooks/scripts/llm-orchestrate.jsView on unpkg · L33

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.26 matchedPath = hooks/scripts/llm-orchestrate.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/llm-orchestrate.jsView on unpkg

dist/cli/postinstall/global-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t.entries(envvars)) { if (!env[key]) { env[key] = value; changed = true; count++; } } if (changed) { fs.writefilesync(globalsettingspath, json.stringify(settings, null, 2) + '\n'); console.log(` ✓ injected ${count} env defaults to settings.json`); } } catch (e) { const message = e instanceof error ? e.message : string(e); console.warn(' ⚠️ failed to inject env defaults: ' + message); } }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/postinstall/global-config.jsView on unpkg

dist/cli/commands/telegram.jsView file

100try { L101: child_process.execSync('npm install playwright', { L102: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/telegram.jsView on unpkg · L100

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

dist/cli/utils/cli-detector.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.26 matchedPath = dist/cli/utils/cli-detector.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/utils/cli-detector.jsView on unpkg

hooks/scripts/auto-format.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.26 matchedPath = hooks/scripts/auto-format.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/auto-format.jsView on unpkg

hooks/scripts/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.26 matchedPath = hooks/scripts/utils.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/utils.jsView on unpkg