registry / Malware / @vibelet/cli

@vibelet/cli

Cross-platform CLI for installing and running the Vibelet daemon

This report shows the evidence for @vibelet/cli@1.2.154. 1 of 23 known versions is blocked or flagged. The newest version, 1.2.220, is flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10720 confirms this npm version as malicious.

Advisory

MAL-2026-10720

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @vibelet/cli (npm)

Details

The @vibelet/cli package ships a daemon bundle (dist/index.cjs, invoked by the `vibelet` bin and by `vibelet start`/`restart`/`reset`) that starts an HTTP+WebSocket server, spawns an interactive PTY running process.env.SHELL via node-pty, and pipes network-received 'input' and 'resize' messages into that PTY. By default the CLI provisions a public Cloudflare tunnel (trycloudflare.com, using the bundled `cloudflared` and `ws` dependencies) that fronts this endpoint, so any remote party that pairs with the daemon (or obtains the tunnel URL together with the short-lived pair token) can execute arbitrary commands in a full interactive shell on the installer's host. The daemon bundle is packed with obfuscator.io-style transforms (string-array dispatcher `_0x9d44`, hex-encoded identifiers, control-flow flattening) rather than ordinary minification, which obscures the network-to-PTY path.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package is not proven malicious, but its obfuscated daemon, persistence, default remote tunnel, and remote coding-agent control create substantial user-host risk. Flag as a warning rather than block because activation is user-invoked and no concrete malicious chain was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `vibelet`, `vibelet start`, `vibelet claude`, or `vibelet codex`.

Impact

A paired remote client may control coding-agent sessions on the host.

Mechanism

Persistent daemon plus tunneled remote terminal-agent control

AI rationale

Evidence

package.jsonREADME.mddist/vibelet.mjsdist/index.cjs~/.vibelet/runtime/current/dist/index.cjs~/.vibelet/relay.json~/.vibelet/tunnel.json

Independent scan evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for AI warning decision

`dist/index.cjs` is heavily obfuscated, limiting auditability of the daemon.
`dist/vibelet.mjs` starts persistent launchd/systemd/detached daemon backends after a user invokes the CLI.
`dist/vibelet.mjs` enables Cloudflare Tunnel remote access by default for start-like commands.
`dist/vibelet.mjs` explicitly launches Claude/Codex integrations and creates temporary Claude hook settings.

Evidence against

`package.json` contains no preinstall, install, postinstall, or prepare lifecycle hook.
The executable is only the user-invoked `vibelet` bin entrypoint.
CLI persistence and configuration target `~/.vibelet`; no foreign AI-agent configuration write was confirmed.
No hardcoded credential-exfiltration endpoint or secret-harvesting path was confirmed in inspected sources.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Source & flagged code

2 flagged

dist/web/assets/codeql-DsOJ9woJ.jsView file

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

dist/web/assets/mermaid-O7DHMXV3-BA2glr4S.jsView file

189contains invisible/control Unicode U+200B (zero width space) `).at(-1);if(s&&s.trim().length>0)return`${e}<U+200B>`}if(aC.test(i)&&!n.match(oC)){let s=r.split(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/mermaid-O7DHMXV3-BA2glr4S.jsView on unpkg · L189

Source & flagged code

2 flagged · loading source

dist/web/assets/codeql-DsOJ9woJ.jsView file

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

dist/web/assets/mermaid-O7DHMXV3-BA2glr4S.jsView file

189contains invisible/control Unicode U+200B (zero width space) `).at(-1);if(s&&s.trim().length>0)return`${e}<U+200B>`}if(aC.test(i)&&!n.match(oC)){let s=r.split(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/mermaid-O7DHMXV3-BA2glr4S.jsView on unpkg · L189

Findings

1 Critical1 High4 Medium5 Low

CriticalTrojan Source Unicodedist/web/assets/mermaid-O7DHMXV3-BA2glr4S.js

HighObfuscated

MediumDynamic Requiredist/web/assets/codeql-DsOJ9woJ.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @vibelet/cli@1.2.154.

The versions list below shows the verdict for each recorded version.

Avoid installing @vibelet/cli@1.2.154. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-16 19:19:38.149Z (UTC).

Source advisory published: 2026-07-16 18:39:32.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

23 known versions

1.2.220latestSuspiciousAI-agent capability abuseWarnPublishedOct 3, 2026, 7:31 PM 1.2.215SuspiciousAI-agent capability abuseWarnPublishedSep 29, 2026, 2:24 PM 1.2.211Clean—AllowPublishedSep 28, 2026, 1:08 PM 1.2.210Clean—AllowPublishedSep 26, 2026, 1:34 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code