Loading npm security reports…

@su-record/vibe@3.2.6: AI-agent policy block | LPM Firewall

registry / @su-record/vibe / 3.2.6

@su-record/vibe@3.2.6

AI Coding Framework for Claude Code — 7+ agents, 51 skills, multi-LLM orchestration

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. npm postinstall mutates broad, foreign AI-agent configuration surfaces without an explicit user command. It installs global agent assets and registers a Codex lifecycle notify program that runs post-turn scripts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of @su-record/vibe

Impact

Changes Claude/Codex/Cursor behavior across projects; Codex turn completion invokes package-controlled auto-commit and devlog code.

Mechanism

postinstall global AI-agent configuration and lifecycle-hook registration

Policy narrative

On npm installation, the package executes postinstall and writes global Claude/Cursor assets. If Codex is present, it modifies ~/.codex/AGENTS.md and registers a package-controlled notify executable in ~/.codex/config.toml. That notify handler runs auto-commit and devlog scripts after Codex agent-turn-complete events, affecting future agent sessions without an explicit setup command.

Rationale

The package contains a concrete, unconsented postinstall mutation of broad AI-agent control surfaces, including a persistent Codex lifecycle executable. This meets the install-control-surface block boundary even though the inspected postinstall path does not exfiltrate data.

Evidence

package.jsondist/cli/postinstall/main.jsdist/cli/postinstall/global-config.jsdist/cli/setup/ProjectSetup.jshooks/scripts/codex-notify.js~/.claude/settings.json~/.claude/CLAUDE.md

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/lib/TaskContext.jsView file

26} L27: static fork(parentContext, forkOpts) { L28: const data = {

High

Child Process

Package source references child process execution.

dist/infra/lib/TaskContext.jsView on unpkg · L26

dist/infra/lib/PythonParser.jsView file

8import os from 'os'; L9: const execAsync = promisify(exec); L10: // Determine Python command based on platform

High

Shell

Package source references shell execution.

dist/infra/lib/PythonParser.jsView on unpkg · L8

dist/tools/convention/applyQualityRules.jsView file

21react: ['dangerouslySetInnerHTML', 'props drilling (3+ levels)'], L22: javascript: ['var usage', '== instead of ===', 'eval() usage'], L23: css: ['!important abuse', 'inline style abuse']

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/convention/applyQualityRules.jsView on unpkg · L21

dist/infra/lib/MemoryManager.jsView file

33try { L34: const fs = require('fs'); L35: if (fs.existsSync(cwdClaudePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/lib/MemoryManager.jsView on unpkg · L33

dist/cli/commands/codex-proxy.jsView file

33console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (data.models || []).map(m => m.slug).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

dist/infra/lib/codex-proxy.jsView file

912const settings = getProxySettings(); L913: const defaultModel = model || process.env.CODEX_PROXY_MODEL || resolveDefaultModel(settings.model); L914: const modelSlots = resolveModelSlots(defaultModel); ... L921: console.log(`Codex Proxy :${port} | ${authLabel} | opus=${modelSlots.opus} sonnet=${modelSlots.sonnet} haiku=${modelSlots.haiku}`); L922: const child = spawn('claude', ['--dangerously-sk[redacted]', ...claudeArgs], { L923: stdio: 'inherit', ... L925: ...process.env, L926: ANTHROPIC_BASE_URL: `http://localhost:${port}`, L927: ANTHROPIC_AUTH_TOKEN: 'codex-proxy',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/infra/lib/codex-proxy.jsView on unpkg · L912

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.4 matchedPath = dist/infra/lib/codex-proxy.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/infra/lib/codex-proxy.jsView on unpkg

dist/cli/commands/telegram.jsView file

100try { L101: child_process.execSync('npm install playwright', { L102: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/telegram.jsView on unpkg · L100

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.4 matchedPath = dist/cli/commands/telegram.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/telegram.jsView on unpkg

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

hooks/scripts/llm-orchestrate.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.4 matchedPath = hooks/scripts/llm-orchestrate.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/scripts/llm-orchestrate.jsView on unpkg

dist/cli/commands/init.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.4 matchedPath = dist/cli/commands/init.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/init.jsView on unpkg

dist/cli/commands/update.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@3.2.4 matchedPath = dist/cli/commands/update.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:3.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/update.jsView on unpkg