Loading npm security reports…

@su-record/vibe@4.1.1: AI-agent control-surface risk | LPM Firewall

registry / @su-record/vibe / 4.1.1

@su-record/vibe@4.1.1

An AX/FDE harness for Claude Code, Codex CLI and ChatGPT desktop. Say what you need, approve the scenarios once; the harness proves the work by running the checks itself. Memory in plain files, human tokens for irreversible actions, a ledger instead of cl

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically modifies detected Claude, Codex, and Hermes agent homes. It adds instruction content, skills, and tool-execution hooks without a separate user setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global npm installation of the package.

Impact

The package gains persistent influence over agent instructions and tool-event handling across user-level agent installations.

Mechanism

Postinstall writes AI-agent configuration and command hooks.

Policy narrative

During a global npm install, postinstall imports setupGlobal. That setup detects agent homes and writes instruction cards, replaces named skills, and adds pre- and post-tool command hooks. The post-tool hook executes the package CLI in the active project. This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Rationale

The automatic lifecycle hook creates persistent AI-agent instruction and hook surfaces in user homes. This meets the policy threshold for malicious install-hook abuse despite the absence of observed secret exfiltration.

Evidence

package.jsonscripts/postinstall.jsdist/install/global.jshooks/notify.js~/.claude/CLAUDE.md~/.claude/skills~/.claude/settings.json~/.codex/AGENTS.md~/.codex/skills~/.codex/hooks.json~/.hermes/SOUL.md~/.hermes/skills

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install/update.jsView file

1import { spawnSync } from 'node:child_process'; L2: import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/install/update.jsView on unpkg · L1

dist/core/checks/run.jsView file

18return new Promise((resolve) => { L19: const child = spawn(check.cmd, { cwd, shell: true, env: { ...process.env, VIBE_CHECK: '1' }, stdio: ['ignore', 'pipe', 'pipe'] }); L20: let captured = '';

High

Shell

Package source references shell execution.

dist/core/checks/run.jsView on unpkg · L18

dist/core/tree.jsView file

1import { createHash } from 'node:crypto'; L2: import { spawnSync } from 'node:child_process'; L3: import fs from 'node:fs'; ... L7: const result = spawnSync('git', args, { cwd: root, encoding: 'utf-8' }); L8: return result.status === 0 ? result.stdout : null; L9: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/tree.jsView on unpkg · L1

dist/core/github.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { readJson } from './store.js'; L3: import { usage } from './errors.js'; L4: const API = 'https://api.github.com'; L5: export function githubToken() { L6: const env = process.env['GITHUB_TOKEN'] ?? process.env['GH_TOKEN']; L7: if (env)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/github.jsView on unpkg · L1

dist/install/global.jsView file

11export const SKILL_NAMES = ['vibe', 'vibe.discover', 'vibe.scope', 'vibe.build', 'vibe.prove', 'vibe.handoff']; L12: const CLIENT_DIR = { claude: '.claude', codex: '.codex', hermes: '.hermes' }; L13: /** User-level layout: one per client home. Codex reads a native `~/.codex/hooks.json` shaped like Claude's settings. */ L14: export function globalLayout(client) { ... L16: if (client === 'claude') L17: return { card: path.join(dir, 'CLAUDE.md'), skills: path.join(dir, 'skills'), hook: path.join(dir, 'settings.json') }; L18: if (client === 'codex') L19: return { card: path.join(dir, 'AGENTS.md'), skills: path.join(dir, 'skills'), hook: path.join(dir, 'hooks.json') }; L20: // Hermes Agent: identity file SOUL.md is the only home-level instruction it always loads; skills follow the agentski

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install/global.jsView on unpkg · L11

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { packageroot } from '../core/paths.js'; import { readjson, readtext, writeatomic, writejson } from '../core/store.js'; import { claudepluginversion, cliavailable, codexregistered, registerclaude, registercodex, unregisterclaude, unregistercodex } from './register.js'; export const all_clients = ['claude', 'codex', 'hermes']; export const card_start = ''; export const card_end = ''; export const card_max_bytes = 1024; export const skill_names = ['vibe', 'vibe.discover', 'vibe.scope', 'vibe.build', 'vibe.prove', 'vibe.handoff']; const client_dir = { claude:

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

Source & flagged code

8 flagged

package.jsonView file

Lines 8-48json

8 },

9 "files": [

10 "dist/",

11 "skills/",

12 "hooks/",

13 "scripts/",

14 ".claude-plugin/",

15 ".codex-plugin/",

16 "card.md",

17 "README.md",

18 "LICENSE"

19 ],

20 "engines": {

21 "node": ">=20.12.0"

22 },

23 "scripts": {

24 "build": "tsc -p tsconfig.json && chmod +x dist/cli.js",

25 "typecheck": "tsc --noEmit -p tsconfig.json",

26 "test": "vitest run",

27 "check": "npm run build && npm test",

28 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "dependencies": {

31 "ajv": "^8.17.1",

32 "yaml": "^2.8.1"

33 },

34 "devDependencies": {

35 "@types/node": "^22.19.10",

36 "tsx": "^4.23.5",

37 "typescript": "^5.9.3",

38 "vitest": "^4.1.10"

39 },

40 "license": "MIT",

41 "repository": "https://github.com/su-record/vibe",

42 "keywords": [

43 "harness",

44 "ax",

45 "fde",

46 "forward-deployed-engineer",

47 "verification",

48 "claude-code",

dist/install/update.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/install/update.jsView on unpkg · L1

3import { packageRoot } from '../core/paths.js';

4import

dist/core/checks/run.jsView file

Lines 1-38javascript

1import { spawn } from 'node:child_process';

2import path from 'node:path';

3const DEFAULT_TIMEOUT_MS = 600_000;

4const TAIL_LINES =

dist/core/tree.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { spawnSync } from 'node:child_process';

3import fs from 'node:fs';

4import path from 'node:path';

dist/core/github.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { readJson } from './store.js';

3import { usage } from './errors.js';

4const API =

dist/install/global.jsView file

Lines 1-31javascript

1import fs from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import { packageRoot } from '../core/paths.js';