@vibelet/cli@1.2.215
Cross-platform CLI for installing and running the Vibelet daemon
AI Security Review
scanned 23d ago · by lpm-firewall-aiInspected source supports guarded, user-invoked agent configuration capability, which the supplied policy classifies as warning-worthy. No concrete block-eligible malicious chain was established.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Launching a managed Claude terminal or daemon-managed Claude session with the required local hook credentials.
Impact
The daemon participates in agent session tracking and tool permission decisions; the inspected setup does not establish global agent configuration hijacking.
Mechanism
Generated settings attach command hooks to Claude processes and forward events to the local daemon.
AI rationale
Inspected source supports guarded, user-invoked agent configuration capability, which the supplied policy classifies as warning-worthy. No concrete block-eligible malicious chain was established.
Evidence
dist/vibelet.mjsdist/index.cjssettings.jsonsession_hook_forwarder.cjs
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI explicitly launches managed agent terminals, where guarded Claude integration supplies generated hook settings.
- Claude settings are created in a temporary directory; hook events are forwarded to the local daemon at 127.0.0.1.
- The daemon generates SessionStart and PreToolUse command hooks and supplies their settings when hook credentials and approval conditions permit.
- package.json declares the CLI entrypoint without npm lifecycle hooks or a runtime self-dependency.
- The flagged inventory worker location adds agent executable directories to PATH.
Evidence against
- No confirmed covert exfiltration or install-time agent configuration mutation was established.
- Terminal hook setup requires a local control token and preserves explicitly supplied Claude settings.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
10 flagged · loading sourcedist/vibelet.mjsView file
20*
L21: * http://www.opensource.org/licenses/mit-license.php
L22: *
...
L1769: // add binary data sequence to buffer
L1770: data.write(buffer)
L1771: })
...
L2832: if (err) cb(err)
L2833: let url = 'data:image/png;base64,'
L2834: url += output.toString('base64')
...
L6266: /* istanbul ignore else */
L6267: if (!process.env.WS_NO_BUFFER_UTIL) {
L6268: try {
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/vibelet.mjsView on unpkg · L2020Trigger-reachable chain: manifest.bin -> dist/vibelet.mjs
L20: *
L21: * http://www.opensource.org/licenses/mit-license.php
L22: *
...
L1769: // add binary data sequence to buffer
L1770: data.write(buffer)
L1771: })
...
L2832: if (err) cb(err)
L2833: let url = 'data:image/png;base64,'
L2834: url += output.toString('base64')
...
L6266: /* istanbul ignore else */
L6267: if (!process.env.WS_NO_BUFFER_UTIL) {
L6268: try {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/vibelet.mjsView on unpkg · L2011254L11255: module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:child_process");
L11256:
High
Findings
3 Critical5 High6 Medium4 Low
CriticalDownload Executedist/vibelet.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/vibelet.mjs
CriticalPrevious Version Dangerous Deltadist/index.cjs
HighChild Processdist/vibelet.mjs
HighEvaldist/vibelet.mjs
HighCross File Remote Execution Contextdist/vibelet.mjs
HighTrigger Reachable Persistencedist/vibelet.mjs
HighObfuscated
MediumDynamic Requiredist/runtime-version.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/vibelet.mjs
MediumShips Native Binarydist/tailcat/vibelet-tailcat-win32-amd64.exe
Affected versions and remediation
This report applies to @vibelet/cli@1.2.215.
See all versions of @vibelet/cli for other recorded verdicts.
- Review the evidence and your use of @vibelet/cli@1.2.215 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.