registry / Credential exfiltration / @trycodev/cli
@trycodev/cli
Secure CoDev cloud coding-agent authentication CLI
This report shows the evidence for @trycodev/cli@0.17.0. 0 of 16 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package transfers Codex credentials to CoDev when the user runs `codev codex-auth`, and provides similar Claude and Cursor auth flows. This is consistent with its stated purpose and is not triggered automatically, but the vendor handoff of other AI-service credentials warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running `codev codex-auth`; Claude and Cursor auth commands also exist.
Impact
CoDev receives credentials for the user's coding-agent account, enabling it to authenticate that agent on the user's behalf.
Mechanism
The CLI obtains credentials through the agent's official login flow, reads them from a temporary auth file or captured output, and submits them to the configured CoDev API using the user's CoDev bearer token.
AI rationale
The package transfers Codex credentials to CoDev when the user runs `codev codex-auth`, and provides similar Claude and Cursor auth flows. This is consistent with its stated purpose and is not triggered automatically, but the vendor handoff of other AI-service credentials warrants a warning.
Evidence
src/client.mjsbin/codev.mjs~/.codev/config.json/tmp/codev-codex-auth-*/auth.json
Network endpoints1
www.trycodev.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package describes itself as a CoDev cloud coding-agent authentication CLI.
- The CLI dispatches `codex-auth` to a dedicated authentication function when that command is run.
- That function starts the official Codex login flow in a temporary `CODEX_HOME`, then reads its `auth.json` and sends the auth cache to `/api/cli/codex-auth`.
- The request includes the user's CoDev bearer token and goes to the configured CoDev API, which defaults to `https://www.trycodev.com`.
- Chat mirroring is off until enabled; setup asks before sending prompts, replies, and tool output to CoDev.
Evidence against
- No install lifecycle scripts are declared; the manifest's scripts are for testing and type checking.
- The Codex credential handoff requires running the dedicated `codev codex-auth` command; it is not triggered at import or install.
- The Codex login runs in a temporary directory and the package removes it afterward.
- The separate chat-mirroring feature has an explicit consent prompt and is disabled by default.
Behavioral surface
ChildProcess
Source & flagged code
13 flaggedsrc/update-check.mjsView file
1import { spawn } from "node:child_process";
L2: import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
High
Child Process
Package source references child process execution.
src/update-check.mjsView on unpkg · L1•matchType = normalized_sha256
matchedPackage = @trycodev/cli@0.14.0
matchedPath = src/update-check.mjs
matchedIdentity = npm:QHRyeWNvZGV2L2NsaQ:0.14.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/update-check.mjsView on unpkgsrc/share-files.mjsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L46: { maxBuffer: 64 << 20, encoding: "buffer" },
L47: (error, stdout) => resolve(error ? null : stdout),
L48: );
...
L57: if (!out) return null;
L58: return [...new Set(out.toString("utf8").split("\0").filter(Boolean))];
L59: }
Findings
1 Critical12 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/client.mjs
HighChild Processsrc/update-check.mjs
HighShell
HighSame File Env Network Executionsrc/client.mjs
HighKnown Malware Source Similaritysrc/client.mjs
HighKnown Malware Source Similaritysrc/update-check.mjs
HighKnown Malware Source Similaritysrc/coordinate-git.mjs
HighKnown Malware Source Similaritysrc/mirror-upload.mjs
HighKnown Malware Source Similaritysrc/update.mjs
HighKnown Malware Source Similaritysrc/coordinate.mjs
HighKnown Malware Source Similaritysrc/setup-codex.mjs
High
Affected versions and remediation
This report applies to @trycodev/cli@0.17.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @trycodev/cli@0.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.