registry / @su-record/vibe / 4.1.22

@su-record/vibe@4.1.22

An AX/FDE harness for Claude Code, Codex CLI and ChatGPT desktop. Say what you need, approve the scenarios once; the harness proves the work by running the checks itself. Memory in plain files, human tokens for irreversible actions, a ledger instead of cl

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Static inspection confirms automatic, opt-out guarded setup of this package’s agent surfaces during global installation. This is a first-party agent extension lifecycle risk, not evidence of a confirmed malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation, unless VIBE_SKIP_SETUP is set.

Impact

Agent homes may receive package-owned instructions, skills, hooks, or plugin registration without a separate setup command.

Mechanism

The postinstall imports setupGlobal, which installs or registers the package’s surfaces for detected clients.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/install/global.jsdist/install/hooks.jsdist/install/plugin.jsdist/install/register.js

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall runs a setup script that proceeds on global installs unless VIBE_SKIP_SETUP is set.
The setup script calls setupGlobal, which installs surfaces for each detected client home.
Home setup writes an instruction card, copies skills, and adds a notification hook to client configuration.
The plugin installer assembles a local plugin tree and updates a marketplace entry.
The register helper reads Claude plugin registration data; this excerpt does not show credential handling or a remote payload.

Evidence against

The install hook exits for non-global installs and supports an explicit VIBE_SKIP_SETUP opt-out.
The inspected install behavior sets up this package’s own agent surfaces; the cited code shows no unrelated agent-control mutation or credential exfiltration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

15 flagged

package.jsonView file

Lines 11-51json

11 "skills/",

12 "reviewers/",

13 "agents/",

14 "hooks/",

15 "scripts/",

16 ".claude-plugin/",

17 ".codex-plugin/",

18 "card.md",

19 "README.md",

20 "LICENSE",

21 "mcpb/"

22 ],

23 "engines": {

24 "node": ">=20.12.0"

25 },

26 "scripts": {

27 "build": "tsc -p tsconfig.json && chmod +x dist/cli.js",

28 "typecheck": "tsc --noEmit -p tsconfig.json",

29 "test": "vitest run",

30 "check": "npm run build && npm test",

31 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 },

33 "dependencies": {

34 "ajv": "^8.17.1",

35 "yaml": "^2.8.1"

36 },

37 "devDependencies": {

38 "@types/node": "^22.19.10",

39 "tsx": "^4.23.5",

40 "typescript": "^5.9.3",

41 "vitest": "^4.1.10"

42 },

43 "license": "MIT",

44 "repository": "https://github.com/su-record/vibe",

45 "keywords": [

46 "harness",

47 "ax",

48 "fde",

49 "forward-deployed-engineer",

50 "verification",

51 "claude-code",

mcpb/server/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * vibe for the Claude desktop app — an MCP Bundle server that is nothing but a cable to the

4 * `vibe` CLI. Every tool runs `vibe <command> --json` in the project folder the user picked at

5 * install time (VIBE_PROJECT_DIR) and returns the JSON. The verdict stays in the CLI; this

6 * surface is for the interview, the approval, the judgement and the handoff — not for writing code.

7 *

8 * MCP over stdio is newline-delimited JSON-RPC 2.0. Three methods matter here: initialize,

9 * tools/list, tools/call. No SDK: the protocol subset is small and the bundle stays dependency-free.

dist/core/checks/run.jsView file

Lines 1-39javascript

1import { spawn } from 'node:child_process';

2import path from 'node:path';

3const DEFAULT_TIMEOUT_MS = 600_000;

4const TAIL_LINES =

dist/core/tree.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { spawnSync } from 'node:child_process';

3import fs from 'node:fs';

4import path from 'node:path';

dist/core/github.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { readJson } from './store.js';

3import { usage } from './errors.js';

4const API =

dist/install/global.jsView file

Lines 1-36javascript

1import fs from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import { packageRoot } from '../core/paths.js';

dist/install/plugin.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. (home = os.homedir()) { const legacy = path.join(home, '.vibe', 'plugin'); if (!fs.existssync(legacy)) return []; fs.rmsync(legacy, { recursive: true, force: true }); const removed = [legacy]; const dotvibe = path.join(home, '.vibe'); if (fs.readdirsync(dotvibe).length === 0) { fs.rmsync(dotvibe, { recursive: true, force: true }); removed.push(dotvibe); } return removed; } export function languagepacks() { const dir = path.join(packageroot(), 'skills'); return fs.existssync(dir) ? fs.readdirsync(dir).filter((n)

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/install/plugin.jsView on unpkg

dist/core/docs/pdf.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/docs/pdf.js#virtual:normalized:round1View on unpkg

dist/core/checks/eval.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@4.1.25 matchedPath = dist/core/checks/eval.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:4.1.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/checks/eval.jsView on unpkg

dist/core/skills.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@4.1.26 matchedPath = dist/core/skills.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:4.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/skills.jsView on unpkg

dist/cli/common.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@4.1.25 matchedPath = dist/cli/common.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:4.1.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/common.jsView on unpkg

dist/core/scenarios.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@4.1.25 matchedPath = dist/core/scenarios.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:4.1.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/scenarios.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

mcpb/server/index.jsView file

10*/ L11: import { spawnSync } from 'node:child_process'; L12: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

mcpb/server/index.jsView on unpkg · L10

Findings

1 Critical12 High4 Medium5 Low

CriticalAi Agent Control Hijackdist/install/global.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processmcpb/server/index.js

HighShelldist/core/checks/run.js

HighSame File Env Network Executiondist/core/github.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install/plugin.js

HighSemantic Analysis Limiteddist/core/docs/pdf.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/core/checks/eval.js

HighKnown Malware Source Similaritydist/core/skills.js

HighKnown Malware Source Similaritydist/cli/common.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @su-record/vibe@4.1.22.

See all versions of @su-record/vibe for other recorded verdicts.

Review the evidence and your use of @su-record/vibe@4.1.22 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 21:48:15.933Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code