Loading npm security reports…

@su-record/vibe@3.2.37: AI-agent control-surface risk | LPM Firewall

registry / @su-record/vibe / 3.2.37

@su-record/vibe@3.2.37

AI Coding Framework for Claude Code — 7+ agents, 52 skills, multi-LLM orchestration

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies global Claude, Codex, and potentially Antigravity agent control surfaces. If Codex is detected, it registers a lifecycle notify program that executes package scripts on later agent-turn completion events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install; Codex-related writes activate when a Codex binary or config directory exists.

Impact

Persistent global agent instructions and automatic execution of package scripts during future Codex lifecycle events.

Mechanism

postinstall global agent configuration injection and notify registration

Policy narrative

The postinstall hook runs without an explicit CLI command. It installs global agent assets, injects global instruction files, and—when Codex is merely detected—writes a global notify entry that launches package scripts after future agent turns. This is an unconsented install-time mutation of broad AI-agent control surfaces.

Rationale

The install hook performs concrete global AI-agent configuration and lifecycle mutations, exceeding package-local setup. Runtime LLM networking is not needed for the block decision.

Evidence

package.jsondist/cli/postinstall/main.jsdist/cli/setup/ProjectSetup.jshooks/scripts/codex-notify.js~/.claude/agents~/.claude/skills~/.claude/CLAUDE.md~/.claude/settings.json~/.codex/AGENTS.md

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(e=>process.stderr.write('\u26a0\ufe0f vibe postinstall skipped: '+((e&&e.message)||e)+'\n Assets and ho...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(e=>process.stderr.write('\u26a0\ufe0f vibe postinstall skipped: '+((e&&e.message)||e)+'\n Assets and ho...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/lib/TaskContext.jsView file

26} L27: static fork(parentContext, forkOpts) { L28: const data = {

High

Child Process

Package source references child process execution.

dist/infra/lib/TaskContext.jsView on unpkg · L26

dist/infra/lib/PythonParser.jsView file

8import os from 'os'; L9: const execAsync = promisify(exec); L10: // Determine Python command based on platform

High

Shell

Package source references shell execution.

dist/infra/lib/PythonParser.jsView on unpkg · L8

dist/tools/convention/applyQualityRules.jsView file

21react: ['dangerouslySetInnerHTML', 'props drilling (3+ levels)'], L22: javascript: ['var usage', '== instead of ===', 'eval() usage'], L23: css: ['!important abuse', 'inline style abuse']

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/convention/applyQualityRules.jsView on unpkg · L21

dist/infra/lib/MemoryManager.jsView file

33try { L34: const fs = require('fs'); L35: if (fs.existsSync(cwdClaudePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/lib/MemoryManager.jsView on unpkg · L33

dist/cli/commands/codex-proxy.jsView file

33Trigger-reachable persistence chain: manifest.main -> dist/cli/index.js -> dist/cli/commands/codex-proxy.js L33: console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (da

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

33console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (data.models || []).map(m => m.slug).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

dist/infra/lib/codex-proxy.jsView file

912const settings = getProxySettings(); L913: const defaultModel = model || process.env.CODEX_PROXY_MODEL || resolveDefaultModel(settings.model); L914: const modelSlots = resolveModelSlots(defaultModel); ... L921: console.log(`Codex Proxy :${port} | ${authLabel} | opus=${modelSlots.opus} sonnet=${modelSlots.sonnet} haiku=${modelSlots.haiku}`); L922: const child = spawn('claude', ['--dangerously-sk[redacted]', ...claudeArgs], { L923: stdio: 'inherit', ... L925: ...process.env, L926: ANTHROPIC_BASE_URL: `http://localhost:${port}`, L927: ANTHROPIC_AUTH_TOKEN: 'codex-proxy',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/infra/lib/codex-proxy.jsView on unpkg · L912

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.36 matchedPath = dist/infra/lib/codex-proxy.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/infra/lib/codex-proxy.jsView on unpkg

hooks/scripts/llm-orchestrate.jsView file

33Source sends the broad process environment to a literal external destination. L33: import crypto from 'crypto'; L34: import { execSync, spawn } from 'child_process'; L35: ... L46: // 낮춰 부모 dispatcher timeout 안에 단일 시도로 끝낸다. (B-2: hard-kill/무음실패 방지) L47: const MAX_RETRIES = Number(process.env.VIBE_LLM_MAX_RETRIES) || 3; L48: // WHY 2000ms initial delay: LLM rate-limit windows are typically 1-5s; ... L215: function spawnCli(cmd, args, options) { L216: // Windows: .cmd shim은 spawn 직접 실행 불가 → cmd.exe /c 로 실행 L217: if (IS_WINDOWS) { ... L251: }); L252: proc.stdin.end(fullPrompt); L253:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

hooks/scripts/llm-orchestrate.jsView on unpkg · L33

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.36 matchedPath = hooks/scripts/llm-orchestrate.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/llm-orchestrate.jsView on unpkg

dist/cli/postinstall/global-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t.entries(envvars)) { if (!env[key]) { env[key] = value; changed = true; count++; } } if (changed) { fs.writefilesync(globalsettingspath, json.stringify(settings, null, 2) + '\n'); console.log(` ✓ injected ${count} env defaults to settings.json`); } } catch (e) { const message = e instanceof error ? e.message : string(e); console.warn(' ⚠️ failed to inject env defaults: ' + message); } }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/postinstall/global-config.jsView on unpkg

dist/cli/commands/telegram.jsView file

100try { L101: child_process.execSync('npm install playwright', { L102: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/telegram.jsView on unpkg · L100

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

dist/cli/utils/cli-detector.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.36 matchedPath = dist/cli/utils/cli-detector.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/utils/cli-detector.jsView on unpkg

hooks/scripts/auto-format.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.36 matchedPath = hooks/scripts/auto-format.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/auto-format.jsView on unpkg

hooks/scripts/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.36 matchedPath = hooks/scripts/utils.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/utils.jsView on unpkg