@trycodev/cli@0.11.0
Secure CoDev cloud coding-agent authentication CLI
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe mirror’s prompt promises secret redaction, but the inspected upload path sends transcript lines as-is, and non-interactive setup defaults the mirror on. This creates a meaningful risk that sensitive content is sent despite the stated protection; the source does not prove that credentials are present in the uploaded lines.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
`codev setup` enables the mirror by default when run non-interactively; later agent hooks upload after a CoDev workspace tool call links the session.
Impact
Chat prompts, replies, tool output, and any secrets present in those lines may reach CoDev contrary to the setup prompt's redaction claim.
Mechanism
The uploader reads transcript lines and POSTs them with the saved CoDev bearer token. No redaction is visible in the inspected upload path.
AI rationale
The mirror’s prompt promises secret redaction, but the inspected upload path sends transcript lines as-is, and non-interactive setup defaults the mirror on. This creates a meaningful risk that sensitive content is sent despite the stated protection; the source does not prove that credentials are present in the uploaded lines.
Evidence
src/mirror.mjssrc/mirror-upload.mjssrc/setup.mjs~/.codev/mirror.json~/.codev/mirror/~/.claude/settings.json~/.codex/hooks.json
Network endpoints1
www.trycodev.com/api/cli/native-sessions (default; API URL is configurable)
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The mirror prompt says prompts, replies and tool output go to CoDev, with secrets redacted.
- When setup is non-interactive, mirror consent falls back to the saved setting, which defaults to enabled.
- The uploader sends transcript lines in its upload body without visible redaction in this path.
- Uploads go to `/api/cli/native-sessions` with the saved CoDev bearer token.
Evidence against
- The mirror prompt discloses that chat content is sent to CoDev and offers an off choice.
- A session is linked only after a CoDev tool call names a workspace.
- Codex and Claude credentials are sent through explicit auth commands to the configured CoDev API.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
14 flaggedsrc/mirror-upload.mjsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
High
Child Process
Package source references child process execution.
src/mirror-upload.mjsView on unpkg · L1•matchType = normalized_sha256
matchedPackage = @trycodev/cli@0.10.0
matchedPath = src/mirror-upload.mjs
matchedIdentity = npm:QHRyeWNvZGV2L2NsaQ:0.10.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/mirror-upload.mjsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @trycodev/cli@0.9.0
matchedIdentity = npm:QHRyeWNvZGV2L2NsaQ:0.9.0
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Findings
1 Critical12 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/client.mjs
HighChild Processsrc/mirror-upload.mjs
HighSame File Env Network Executionsrc/client.mjs
HighKnown Malware Source Similaritysrc/client.mjs
HighKnown Malware Source Similaritysrc/coordinate-git.mjs
HighKnown Malware Source Similaritysrc/mirror-daemon.mjs
HighKnown Malware Source Similaritysrc/mirror-upload.mjs
HighKnown Malware Source Similaritysrc/mirror.mjs
HighKnown Malware Source Similaritysrc/clone.mjs
HighKnown Malware Source Similaritysrc/coordinate.mjs
HighKnown Malware Source Similaritysrc/setup-codex.mjs
Affected versions and remediation
This report applies to @trycodev/cli@0.11.0.
See all versions of @trycodev/cli for other recorded verdicts.
- Review the evidence and your use of @trycodev/cli@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.