registry / @vibeapi/cli / 0.0.167
@vibeapi/cli@0.0.167
CLI tool for managing AI coding assistants (Claude Code, Codex, OpenClaw, Hermes, AtomCode, Grok Build) with one unified config
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe flagged process, persistence, and install behaviors support the package’s stated CLI purpose. Its runtime telemetry is disclosed, carries command and error statistics to the configured gateway, and has an opt-out; no attack behavior was identified in the reviewed source.
Static reason
One or more suspicious static signals were detected.
Trigger
Telemetry runs during CLI command execution; installation, environment changes, and plugin setup are exposed through CLI operations.
Impact
No malicious behavior was found in the inspected paths.
Mechanism
Telemetry sends command and error statistics to the configured gateway, with API-key masking and an opt-out. The inspected shell and persistence code provides tool installation and environment configuration functions.
AI rationale
The flagged process, persistence, and install behaviors support the package’s stated CLI purpose. Its runtime telemetry is disclosed, carries command and error statistics to the configured gateway, and has an opt-out; no attack behavior was identified in the reviewed source.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a CLI for configuring and managing AI coding tools.
- Telemetry disclosure says usage statistics include commands and error messages, exclude API keys, and can be disabled with an environment variable.
- Telemetry is disabled when the configured telemetry variable is 0, false, or off.
- Telemetry events are sent through the configured gateway; requests use the configured base URL and API key.
- Persistent environment writes and tool installation commands are implemented as CLI capabilities.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/lib/tools/chatgpt-desktop.jsView file
1import{spawnSync as t}from"child_process";import{logger as n}from"../../utils/logger.js";import{brand as e}from"../brand.js";import{powerShellEnv as r}from"../powershell-env.js";im...
High
Child Process
Package source references child process execution.
dist/lib/tools/chatgpt-desktop.jsView on unpkg · L1dist/lib/tools/tool-installs.jsView file
1import{spawnSync as t}from"child_process";import{existsSync as n,realpathSync as r,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
High
1import{spawnSync as t}from"child_process";import{existsSync as n,realpathSync as r,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
Findings
5 High4 Medium4 Low
HighChild Processdist/lib/tools/chatgpt-desktop.js
HighShelldist/lib/tools/tool-installs.js
HighSame File Env Network Executiondist/lib/tools/claude-desktop-cli.js
HighTrigger Reachable Persistencedist/lib/env-cleanup.js
HighRuntime Package Installdist/lib/tools/tool-installs.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/persistent-env.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @vibeapi/cli@0.0.167.
See all versions of @vibeapi/cli for other recorded verdicts.
- Review the evidence and your use of @vibeapi/cli@0.0.167 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.