@vibelet/cli@1.2.210

Cross-platform CLI for installing and running the Vibelet daemon

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The package is a user-invoked daemon CLI with no registry lifecycle scripts. The agent-integration hits only append existing Claude and Codex bin directories to PATH for child processes.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A person runs the vibelet bin. npm install does not execute package code.

Impact

No confirmed credential theft, remote payload, or foreign agent-config mutation from install or import.

Mechanism

The CLI builds a service PATH that includes the user .claude/bin and .codex standalone bin directories, then may start the local daemon. Those paths are not written as agent configuration.

AI rationale

The package is a user-invoked daemon CLI with no registry lifecycle scripts. The agent-integration hits only append existing Claude and Codex bin directories to PATH for child processes.

Decision evidence

public snapshot

AI called this Clean at 74.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

package.json exposes only the vibelet bin at dist/vibelet.mjs and has no preinstall, install, or postinstall hook and no dependency on itself.
dist/vibelet.mjs runs as the user CLI. The flagged .claude and .codex paths are directories added to PATH so daemon-spawned claude and codex wrappers can find node, not writes to agent config.
The same PATH construction appears in obfuscated dist/index.cjs, which the CLI starts as the daemon entry rather than an npm install hook.

Evidence against

dist/index.cjs and dist/inventory-scan-worker.cjs are obfuscated, so not every string is readable.
When the user runs the CLI it can install a per-user daemon and a Cloudflare quick tunnel, which is the stated product behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

10 flagged

dist/vibelet.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module";

3/******/ var __webpack_modules__ = ({

5/***/ 1635:

6/***/ ((module) => {

10/******************************************************************************

11 * Created 2008-08-19.

12 *

13 * Dijkstra path-finding functions. Adapted from the Dijkstar Python project.

14 *

16 * Wyatt Baldwin <self@wyattbaldwin.com>

18 *

19 * Licensed under the MIT license.

20 *

21 * http://www.opensource.org/licenses/mit-license.php

22 *

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/vibelet.mjsView on unpkg · L20

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/vibelet.mjsView on unpkg · L20

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/vibelet.mjsView on unpkg · L20

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/vibelet.mjsView on unpkg · L20

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/vibelet.mjsView on unpkg · L20

23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

24 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

25 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

26 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

27 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

28 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

29 * THE SOFTWARE.

30 *****************************************************************************/

31var dijkstra = {

32 single_source_shortest_paths: function(graph, s, d) {

33 // Predecessor map for each node that has been encountered.

34 // node ID => predecessor node ID

35 var predecessors = {};

37 // Costs of shortest paths from s to all nodes encountered.

38 // node ID => cost

39 var costs = {};

40 costs[s] = 0;

Lines 11162-11202javascript

11162 *

11163 * @private

11164 */

11165function socketOnError() {

11166 const websocket = this[kWebSocket];

11167

11168 this.

Lines 11234-11274javascript

11234module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("http");

11235

11236/***/ }),

11237

11238/***/ 5692:

11239/***/ ((module)

dist/runtime-version.cjsView file

Lines 1-3javascript

1var c=require("node:fs"),n=require("node:path"),p="@vibelet/cli";function i(r){try{let e=JSON.parse

dist/tailcat/vibelet-tailcat-win32-amd64.exeView file

•path = dist/tailcat/vibelet-tailcat-win32-amd64.exe kind = native_binary sizeBytes = 19864576 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/tailcat/vibelet-tailcat-win32-amd64.exeView on unpkg

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vibelet/cli@1.2.185 matchedIdentity = npm:QHZpYmVsZXQvY2xp:1.2.185 similarity = 0.684 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

Source & flagged code

10 flagged · loading source

dist/vibelet.mjsView file

20* L21: * http://www.opensource.org/licenses/mit-license.php L22: * ... L1769: // add binary data sequence to buffer L1770: data.write(buffer) L1771: }) ... L2832: if (err) cb(err) L2833: let url = 'data:image/png;base64,' L2834: url += output.toString('base64') ... L6266: /* istanbul ignore else */ L6267: if (!process.env.WS_NO_BUFFER_UTIL) { L6268: try {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/vibelet.mjsView on unpkg · L20

20Trigger-reachable chain: manifest.bin -> dist/vibelet.mjs L20: * L21: * http://www.opensource.org/licenses/mit-license.php L22: * ... L1769: // add binary data sequence to buffer L1770: data.write(buffer) L1771: }) ... L2832: if (err) cb(err) L2833: let url = 'data:image/png;base64,' L2834: url += output.toString('base64') ... L6266: /* istanbul ignore else */ L6267: if (!process.env.WS_NO_BUFFER_UTIL) { L6268: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/vibelet.mjsView on unpkg · L20

11254L11255: module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:child_process"); L11256:

High

Findings

3 Critical6 High6 Medium4 Low

CriticalDownload Executedist/vibelet.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/vibelet.mjs

CriticalPrevious Version Dangerous Deltadist/index.cjs

HighChild Processdist/vibelet.mjs

HighShell

HighEvaldist/vibelet.mjs

HighCross File Remote Execution Contextdist/vibelet.mjs

HighTrigger Reachable Persistencedist/vibelet.mjs

HighObfuscated

MediumDynamic Requiredist/runtime-version.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/vibelet.mjs

Medium

Affected versions and remediation

This report applies to @vibelet/cli@1.2.210.

See all versions of @vibelet/cli for other recorded verdicts.

Review the evidence and your use of @vibelet/cli@1.2.210 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 15:18:54.954Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.