Loading npm security reports…

@verne-build/cli@0.0.37: Malicious npm security report (Block) | LPM Firewall

registry / @verne-build/cli / 0.0.37

@verne-build/cli@0.0.37

AI Security Review

scanned 3h ago · by lpm-firewall-ai

When the user runs the Verne CLI/server, it reads identifiers from AI-agent authentication files and uses them as a telemetry identity. Telemetry is enabled by default and sends the hashed identifier, platform details, and startup project counts to PostHog.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the verne command and starting its server.

Impact

This enables unconsented cross-tool user tracking and disclosure of local project usage metadata.

Mechanism

Default telemetry fingerprints AI-agent account identifiers and posts event batches.

Attack narrative

The package's executable initializes telemetry on server startup. It first reads Codex or Claude authentication files, extracts an account identifier, hashes it, and uses that value as the telemetry distinct identifier. With telemetry enabled by default, it posts batches containing that identifier, platform details, and startup project and thread counts to PostHog. The behavior is activated by normal CLI use rather than installation.

Rationale

The package performs concrete, default-on exfiltration of identifiers derived from unrelated AI-agent authentication files to a third party. Hashing reduces direct disclosure but does not remove the tracking and privacy impact.

Evidence

dist/bin.mjs~/.codex/auth.json~/.claude.json

Network endpoints1

us.i.posthog.com/batch/

Decision evidence

Source & flagged code

24 flagged · loading source

dist/NodeServices-Bqkx8Bg9.mjsView file

5import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

5Cross-file remote execution chain: dist/NodeServices-Bqkx8Bg9.mjs spawns dist/Schema-BvfDeHKs.mjs; helper contains network access plus dynamic code execution. L5: import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream"; ... L76: * operating-system processes. A spawner turns a command description into a L77: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L78: * the process, and manage whether the process keeps its parent alive. Platform ... L433: return callback(function loop(resume) { L434: for (; i < chunk.length;) if (!options.writable.write(chunk[i++], options.encoding)) { L435: options.writable.once("drain", () => loop(resume)); ... L675: return options.extendEn

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/NodeServices-Bqkx8Bg9.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg

dist/bin.mjsView file

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

dist/resource-monitor/darwin-x64/t3-resource-monitorView file

•path = dist/resource-monitor/darwin-x64/t3-resource-monitor kind = native_binary sizeBytes = 563048 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-x64/t3-resource-monitorView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-gDftfLbP.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/NodePtyAdapter-gDftfLbP.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-gDftfLbP.mjsView on unpkg

dist/service-launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/service-launcher.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service-launcher.mjsView on unpkg

dist/BunPtyAdapter-VCmyFG3E.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-VCmyFG3E.mjsView on unpkg

Source & flagged code

24 flagged

dist/NodeServices-Bqkx8Bg9.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3import { $l as Service, $r as flatMap, Ad as pipe, Dd as dual, Di as map, Ds as done, Er as asVoid, Ji as raceFirst, Lr as catch_, Mo as succeed$3, Or as callback, Os as fail$2, Ou as match, Pi as matchEffect, Qi as runFork, Qo as doneUnsafe, Ro as addFinalizer, Rr as clockWith, Rt as tag, Sa as try_, So as effect, Ta as uninterruptible, Vi as orDie, Vu as Prototype, Wr as effectify, Xl as succeed, Xo as _await, Zu as BaseProto, _r as addFinalizer$1, _s as succeed$2, _u as fromNullishOr, ai as forever, ao as isDoneCause, ba as timeoutOrElse, ci as forkIn, d as ErrorClass, dd as hasProperty, ds ...

4import { At as isSink, Cn as badArgument, Dt as drain, E as fromChannel$1, F as isStream, H as mkString, It as fromTransform, J as pipeThroughChannelOrFail, Lt as mapDone, Q as runCollect, Qt as offer, V as merge, Xt as failCauseUnsafe, Z as run, Zt as make$10, _ as empty, _t as

5import { createRequire } from "node:module";

6import * as NodeChildProcess from "node:child_process";

7import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

8import * as NodeCrypto from "node:crypto";

9import * as NFS from "node:fs";

10import * as OS from "node:os";

11import * as Path from "node:path";

12import * as NodeUrl from "node:url";

13import * as readline from "node:readline";

14//#region \0rolldown/runtime.js

15var __create = Object.create;

16var __defProp = Object.defineProperty;

17var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

18var __getOwnPropNames = Object.getOwnPropertyNames;

19var __getProtoOf = Object.getPrototypeOf;

20var __hasOwnProp = Object.prototype.hasOwnProperty;

21var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

22var __exportAll = (all, no_symbols) => {

23 let target = {};

24 for (var name in all) __defProp(target, name, {

25 get: all[name],

Long lines were clipped for display.

5Cross-file remote execution chain: dist/NodeServices-Bqkx8Bg9.mjs spawns dist/Schema-BvfDeHKs.mjs; helper contains network access plus dynamic code execution. L5: import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream"; ... L76: * operating-system processes. A spawner turns a command description into a L77: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L78: * the process, and manage whether the process keeps its parent alive. Platform ... L433: return callback(function loop(resume) { L434: for (; i < chunk.length;) if (!options.writable.write(chunk[i++], options.encoding)) { L435: options.writable.once("drain", () => loop(resume)); ... L675: return options.extendEn

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/NodeServices-Bqkx8Bg9.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg

dist/bin.mjsView file

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

dist/resource-monitor/darwin-x64/t3-resource-monitorView file

•path = dist/resource-monitor/darwin-x64/t3-resource-monitor kind = native_binary sizeBytes = 563048 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-x64/t3-resource-monitorView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-gDftfLbP.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/NodePtyAdapter-gDftfLbP.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-gDftfLbP.mjsView on unpkg

dist/service-launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/service-launcher.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service-launcher.mjsView on unpkg

dist/BunPtyAdapter-VCmyFG3E.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.36 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-VCmyFG3E.mjsView on unpkg