registry / Credential exfiltration / @verne-build/cli

@verne-build/cli

This report shows the evidence for @verne-build/cli@0.0.37. 2 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package performs concrete, default-on exfiltration of identifiers derived from unrelated AI-agent authentication files to a third party. Hashing reduces direct disclosure but does not remove the tracking and privacy impact.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the verne command and starting its server.

Impact

This enables unconsented cross-tool user tracking and disclosure of local project usage metadata.

Mechanism

Default telemetry fingerprints AI-agent account identifiers and posts event batches.

Attack narrative

The package's executable initializes telemetry on server startup. It first reads Codex or Claude authentication files, extracts an account identifier, hashes it, and uses that value as the telemetry distinct identifier. With telemetry enabled by default, it posts batches containing that identifier, platform details, and startup project and thread counts to PostHog. The behavior is activated by normal CLI use rather than installation.

AI rationale

Evidence

dist/bin.mjs~/.codex/auth.json~/.claude.json

Network endpoints1

us.i.posthog.com/batch/

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The CLI reads account identifiers from Codex and Claude authentication files.
Telemetry is enabled by default and sends a hashed identifier with host and usage metadata to PostHog.
A server-start heartbeat records project and thread counts automatically.

Evidence against

The manifest has no npm lifecycle scripts, so this does not run during installation.
The source hashes the selected account identifier before transmission and offers an environment-variable opt-out.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

Manifest

NoLicense

scanned 397 file(s), 15.1 MB of source, external domains: 127.0.0.1, api.example.com, example.com, github.com, raw.githubusercontent.com, react.dev, relay.invalid, rolldown.rs, www.w3.org

Source & flagged code

24 flagged

dist/NodeServices-Bqkx8Bg9.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import { $l as Service, $r as flatMap, Ad as pipe, Dd as dual, Di as map, Ds as done, Er as asVoid, Ji as raceFirst, Lr as catch_, Mo as succeed$3, Or as callback, Os as fail$2, Ou as match, Pi as matchEffect, Qi as runFork, Qo as doneUnsafe, Ro as addFinalizer, Rr as clockWith, Rt as tag, Sa as try_, So as effect, Ta as uninterruptible, Vi as orDie, Vu as Prototype, Wr as effectify, Xl as succeed, Xo as _await, Zu as BaseProto, _r as addFinalizer$1, _s as succeed$2, _u as fromNullishOr, ai as forever, ao as isDoneCause, ba as timeoutOrElse, ci as forkIn, d as ErrorClass, dd as hasProperty, ds ...

4import { At as isSink, Cn as badArgument, Dt as drain, E as fromChannel$1, F as isStream, H as mkString, It as fromTransform, J as pipeThroughChannelOrFail, Lt as mapDone, Q as runCollect, Qt as offer, V as merge, Xt as failCauseUnsafe, Z as run, Zt as make$10, _ as empty, _t as

5import { createRequire } from "node:module";

6import * as NodeChildProcess from "node:child_process";

7import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

8import * as NodeCrypto from "node:crypto";

9import * as NFS from "node:fs";

10import * as OS from "node:os";

11import * as Path from "node:path";

12import * as NodeUrl from "node:url";

13import * as readline from "node:readline";

14//#region \0rolldown/runtime.js

15var __create = Object.create;

16var __defProp = Object.defineProperty;

17var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

18var __getOwnPropNames = Object.getOwnPropertyNames;

19var __getProtoOf = Object.getPrototypeOf;

20var __hasOwnProp = Object.prototype.hasOwnProperty;

21var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

22var __exportAll = (all, no_symbols) => {

23 let target = {};

24 for (var name in all) __defProp(target, name, {

25 get: all[name],

Long lines were clipped for display.

5Cross-file remote execution chain: dist/NodeServices-Bqkx8Bg9.mjs spawns dist/Schema-BvfDeHKs.mjs; helper contains network access plus dynamic code execution. L5: import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream"; ... L76: * operating-system processes. A spawner turns a command description into a L77: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L78: * the process, and manage whether the process keeps its parent alive. Platform ... L433: return callback(function loop(resume) { L434: for (; i < chunk.length;) if (!options.writable.write(chunk[i++], options.encoding)) { L435: options.writable.once("drain", () => loop(resume)); ... L675: return options.extendEn

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/NodeServices-Bqkx8Bg9.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg

dist/bin.mjsView file

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

dist/resource-monitor/darwin-x64/t3-resource-monitorView file

•path = dist/resource-monitor/darwin-x64/t3-resource-monitor kind = native_binary sizeBytes = 563048 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-x64/t3-resource-monitorView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-gDftfLbP.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/NodePtyAdapter-gDftfLbP.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-gDftfLbP.mjsView on unpkg

dist/service-launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/service-launcher.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service-launcher.mjsView on unpkg

dist/BunPtyAdapter-VCmyFG3E.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-VCmyFG3E.mjsView on unpkg

Source & flagged code

24 flagged · loading source

dist/NodeServices-Bqkx8Bg9.mjsView file

5import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

Findings

4 Critical15 High9 Medium4 Low

CriticalSensitive Archive Exfiltrationdist/bin.mjs

CriticalCredential Exfiltrationdist/bin.mjs

CriticalEncrypted Payload Temp Executiondist/bin.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs

HighChild Processdist/NodeServices-Bqkx8Bg9.mjs

HighShelldist/bin.mjs

HighCredential Redirect Persistencedist/bin.mjs

HighCommand Output Exfiltrationdist/bin.mjs

HighSandbox Evasion Gated Capabilitydist/bin.mjs

HighRemote Agent Bridgedist/bin.mjs

HighCross File Remote Execution Contextdist/NodeServices-Bqkx8Bg9.mjs

High

Affected versions and remediation

This report applies to @verne-build/cli@0.0.37.

The versions list below shows the verdict for each recorded version.

Avoid installing @verne-build/cli@0.0.37. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-01 14:20:17.046Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.0.37latestshownMaliciousCredential ExfiltrationBlockPublishedSep 1, 2026, 2:15 PM 0.0.36MaliciousData ExfiltrationBlockPublishedSep 1, 2026, 1:31 PM 0.0.35Clean—AllowPublishedSep 1, 2026, 1:15 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code