Loading npm security reports…

@su-record/vibe@3.2.3: AI-agent policy block | LPM Firewall

registry / @su-record/vibe / 3.2.3

@su-record/vibe@3.2.3

AI Coding Framework for Claude Code — 7+ agents, 51 skills, multi-LLM orchestration

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package mutates global AI-agent configuration and installs global agent/skill assets. When Codex is detected, it registers a lifecycle command that executes on later agent turns.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; subsequent Codex agent-turn-complete events

Impact

Unconsented persistent control of Claude/Cursor/Codex behavior, including later auto-commit/devlog execution.

Mechanism

global AI-agent configuration injection and lifecycle command registration

Policy narrative

The automatic postinstall copies package-controlled assets into global Claude and Cursor directories. If Codex is present, it writes ~/.codex/AGENTS.md and injects a notify program into ~/.codex/config.toml. That notify adapter executes package-controlled auto-commit and devlog scripts after future Codex agent turns, creating an unconsented persistent broad AI-agent control surface.

Rationale

This is concrete, unconsented postinstall mutation of foreign global AI-agent control surfaces, including a persistent Codex lifecycle execution hook. The absence of install-time network activity does not mitigate that control-surface hijack.

Evidence

package.jsondist/cli/postinstall/main.jsdist/cli/postinstall/fs-utils.jsdist/cli/setup/ProjectSetup.jshooks/scripts/codex-notify.js~/.claude/agents/~/.claude/skills/~/.claude/CLAUDE.md~/.claude/settings.json

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/lib/TaskContext.jsView file

26} L27: static fork(parentContext, forkOpts) { L28: const data = {

High

Child Process

Package source references child process execution.

dist/infra/lib/TaskContext.jsView on unpkg · L26

dist/infra/lib/PythonParser.jsView file

8import os from 'os'; L9: const execAsync = promisify(exec); L10: // Determine Python command based on platform

High

Shell

Package source references shell execution.

dist/infra/lib/PythonParser.jsView on unpkg · L8

dist/tools/convention/applyQualityRules.jsView file

21react: ['dangerouslySetInnerHTML', 'props drilling (3+ levels)'], L22: javascript: ['var usage', '== instead of ===', 'eval() usage'], L23: css: ['!important abuse', 'inline style abuse']

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/convention/applyQualityRules.jsView on unpkg · L21

dist/infra/lib/MemoryManager.jsView file

33try { L34: const fs = require('fs'); L35: if (fs.existsSync(cwdClaudePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/lib/MemoryManager.jsView on unpkg · L33

dist/cli/commands/codex-proxy.jsView file

33console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (data.models || []).map(m => m.slug).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

dist/infra/lib/codex-proxy.jsView file

912const settings = getProxySettings(); L913: const defaultModel = model || process.env.CODEX_PROXY_MODEL || resolveDefaultModel(settings.model); L914: const modelSlots = resolveModelSlots(defaultModel); ... L921: console.log(`Codex Proxy :${port} | ${authLabel} | opus=${modelSlots.opus} sonnet=${modelSlots.sonnet} haiku=${modelSlots.haiku}`); L922: const child = spawn('claude', ['--dangerously-sk[redacted]', ...claudeArgs], { L923: stdio: 'inherit', ... L925: ...process.env, L926: ANTHROPIC_BASE_URL: `http://localhost:${port}`, L927: ANTHROPIC_AUTH_TOKEN: 'codex-proxy',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/infra/lib/codex-proxy.jsView on unpkg · L912

dist/cli/commands/telegram.jsView file

100try { L101: child_process.execSync('npm install playwright', { L102: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/telegram.jsView on unpkg · L100

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

dist/cli/commands/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @su-record/vibe@3.1.0 matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.1.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/init.jsView on unpkg

skills/vibe.e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/vibe.e2e-commerce/templates/test-scenarios.md

skills/vibe.e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121

Source & flagged code

13 flagged

package.jsonView file

Lines 15-55json

15 "./memory": {

16 "types": "./dist/infra/lib/memory/index.d.ts",

17 "default": "./dist/infra/lib/memory/index.js"

18 }

19 },

20 "bin": {

21 "vibe": "dist/cli/index.js"

22 },

23 "scripts": {

24 "build": "tsc && chmod +x dist/cli/index.js",

25 "dev": "tsc --watch",

26 "gen:skill-docs": "npx tsx scripts/gen-skill-docs.ts",

27 "gen:skill-docs:check": "npx tsx scripts/gen-skill-docs.ts --check",

28 "sync:agent-models": "npx tsx scripts/sync-agent-models.ts",

29 "sync:agent-models:check": "npx tsx scripts/sync-agent-models.ts --check",

30 "validate:skill-invocation": "npx tsx scripts/validate-skill-invocation.ts",

31 "validate:counts": "npx tsx scripts/validate-counts.ts",

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "prepublishOnly": "pnpm build",

35 "postinstall": "node -e \"import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L35

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "release": "pnpm version patch && git push origin main --follow-tags"

37 },

38 "keywords": [

39 "ai",

40 "core",

41 "coding",

42 "spec-driven",

43 "claude",

44 "agent",

45 "requirements",

46 "user-story",

47 "ultrawork",

48 "parallel-agents",

49 "memory-management",

50 "knowledge-graph",

51 "code-analysis",

52 "code-quality",

53 "harness"

54 ],

55 "author": "Su",

dist/infra/lib/TaskContext.jsView file

Lines 6-46javascript

6// ============================================================================

7// TaskContext (static registry)

8// ============================================================================

9export class TaskContext {

10 static registry = new Map();

dist/infra/lib/PythonParser.jsView file

Lines 1-28javascript

1// Python code parser utility for v1.3

2// Uses Python's ast module via child_process

3import { exec } from 'child_process';

4import { promisify } from 'util';

5import { writeFile, unlink } from 'fs/promises';

6

dist/tools/convention/applyQualityRules.jsView file

Lines 1-41javascript

1// Convention management tool - completely independent

2// Code Quality Standards

3const QUALITY_RULES = {

4 NAMING: {

5 variables: 'nouns (userList, userData)',

6 functions: 'verb+noun (fetchData, updateUser)',

7 events: 'handle prefix (handleClick, handleSubmit)'

dist/infra/lib/MemoryManager.jsView file

Lines 13-53javascript

13 storage;

14 graph;

15 memorySearch;

16 observations;

17 sessionRAG;

18 ragRetriever;

19 reflections;

20 // Map of projectPath -> MemoryManager instance (for project-based memory)

21 static instances = new Map

dist/cli/commands/codex-proxy.jsView file

Lines 13-53javascript

13 'codex-cli': 'Codex CLI (ChatGPT Pro)',

14 'apikey': 'API Key',

15 'env': 'CODEX_PROXY_API_KEY',

16};

17// ─── 실행 ────────────────────────────────────────────────────

18export function

dist/infra/lib/codex-proxy.jsView file

Lines 892-932javascript

892 // Sonnet → codex 코딩 모델 (spark 제외, 정확도 우선)

893 const codexModel = models.find(m => m.includes('codex') && !m.includes('mini'

dist/cli/commands/telegram.jsView file

100try { L101: child_process.execSync('npm install playwright', { L102: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/telegram.jsView on unpkg · L100

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

dist/cli/commands/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @su-record/vibe@3.1.0 matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.1.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/init.jsView on unpkg

skills/vibe.e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/vibe.e2e-commerce/templates/test-scenarios.md

skills/vibe.e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121