registry / @vibeapi/api-helper / 0.0.141
@vibeapi/api-helper@0.0.141
CLI tool for managing AI coding assistants (Claude Code, Codex, OpenClaw, Hermes, AtomCode, Grok Build) with one unified config
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe new startup updater automatically replaces and reruns the globally installed CLI when a newer release is available, which is a meaningful default behavior users should know about. The update is for this package from configured registries, and the reviewed sources show no unrelated payload or concrete malicious activity, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running a command from a globally installed package, unless the command or environment opts out.
Impact
A registry release can change the code run by the user's next CLI invocation without an explicit update command.
Mechanism
The CLI checks configured registries, runs npm or pnpm global installation for a newer version, then reexecutes itself.
AI rationale
The new startup updater automatically replaces and reruns the globally installed CLI when a newer release is available, which is a meaningful default behavior users should know about. The update is for this package from configured registries, and the reviewed sources show no unrelated payload or concrete malicious activity, so this warrants a warning rather than a block.
Evidence
dist/lib/command.jsdist/lib/auto-update.jsdist/brand.json~/.vibecli/update-state.json (or the configured VIBECLI config directory)Global installation of @vibeapi/api-helper and its command shims
Network endpoints4
npm.cnb.coolregistry.npmjs.orgregistry.npmmirror.comregistry.yarnpkg.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Normal CLI commands call the new startup updater before command execution.
- For global installs, the updater installs a newer release with npm or pnpm and then reexecutes the CLI.
- The update notice says updating is in progress and that Ctrl+C cancels it.
- Runtime telemetry is described in the English locale and can be disabled with the package-prefixed environment variable.
Evidence against
- The updater is limited to global installs and skips help, version, completion, update commands, and configured opt-outs.
- The updater uses configured package registries for this package; no unrelated downloaded payload or credential theft was identified.
- No install lifecycle hooks are declared in package.json.
Behavioral surface
ChildProcessEnvironmentVarsNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/lib/tools/desktop-process.jsView file
1import{spawnSync as e}from"child_process";import{logger as t}from"../../utils/logger.js";export const WINDOWS_PACKAGE_FAMILIES=["Claude_pzs8sxrjxfjjc","AnthropicPBC.Claude_fnn82j28...
High
Child Process
Package source references child process execution.
dist/lib/tools/desktop-process.jsView on unpkg · L1dist/lib/tools/tool-installs.jsView file
1import{spawnSync as t}from"child_process";import{existsSync as r,realpathSync as n,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
High
1import{spawnSync as t}from"child_process";import{existsSync as r,realpathSync as n,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
Findings
1 Critical5 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/lib/auto-update.js
HighChild Processdist/lib/tools/desktop-process.js
HighShelldist/lib/tools/tool-installs.js
HighSame File Env Network Executiondist/lib/tools/claude-desktop-cli.js
HighTrigger Reachable Persistencedist/lib/env-cleanup.js
HighRuntime Package Installdist/lib/tools/tool-installs.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/persistent-env.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @vibeapi/api-helper@0.0.141.
See all versions of @vibeapi/api-helper for other recorded verdicts.
- Review the evidence and your use of @vibeapi/api-helper@0.0.141 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.