registry / @vibgrate/cli / 2026.806.2

@vibgrate/cli@2026.806.2

vg — local codebase intelligence CLI + MCP server for AI coding agents: deterministic code graph, drift reporting, and version-correct library docs (Apache-2.0)

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs `vg install` with selected assistants or `--all`/`--detect`.

Impact

Can influence configured AI assistants and register `vg serve` in the project.

Mechanism

Explicit AI-agent skill, MCP, and instruction-file installation.

AI rationale

Source confirms explicit-user-command mutation of AI-agent control files, which warrants a warning under policy. The scanner's alleged install-time credential/command-output exfiltration is not supported: uploads require a user-invoked DSN-authenticated command.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.jsdist/chunk-ZPPDKHGL.jsdist/chunk-QDKFGLI3.js.claude/skills/vg/SKILL.md.mcp.json.cursor/mcp.json.vscode/mcp.jsonAGENTS.md.vibgrate/mcp-navigation.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`vg install` writes skills, MCP entries, and agent instruction nudges.
It targets many third-party AI assistant project config paths.
Installed nudge text directs agents to prefer this package's MCP tools.

Evidence against

`postinstall` only clears this package's model-health cache and checks a CLI-name conflict.
No install-time network request or AI-agent config mutation was found.
Cloud upload is an explicit DSN-authenticated CLI action, not covert exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 90 file(s), 2.26 MB of source, external domains: 127.0.0.1, api.github.com, api.nuget.org, api.openai.com, api.osv.dev, api.together.xyz, api.vibgrate.com, artifacthub.io, crates.io, cwe.mitre.org, dash.vibgrate.com, digital-strategy.ec.europa.eu, eur-lex.europa.eu, github.com, hex.pm, html.duckduckgo.com, hub.docker.com, huggingface.co, in-toto.io, ollama.com, openrouter.ai, openvex.dev, owasp.org, packages.ecosyste.ms, proxy.golang.org, pub.dev, pypi.org, raw.githubusercontent.com, registry.npmjs.org, registry.terraform.io, repo.packagist.org, rubygems.org, search.maven.org, spdx.org, spec.openapis.org, vibgrate.com, www.aicpa-cima.com, www.cisa.gov, www.iso.org, www.nist.gov, www.rfc-editor.org

Source & flagged code

14 flagged

package.jsonView file

Lines 30-70json

30 "types": "./dist/index.d.ts",

31 "import": "./dist/index.js"

32 }

33 },

34 "files": [

35 "dist",

36 "grammars",

37 "skills",

38 "scripts/postinstall.mjs",

39 "LICENSE",

40 "NOTICE",

41 "README.md",

42 "DOCS.md"

43 ],

44 "scripts": {

45 "build": "pnpm run bundle:grammars && tsup",

46 "bundle:grammars": "node scripts/bundle-grammars.mjs",

47 "stamp:pins": "node scripts/stamp-release-pins.mjs",

48 "check:pins": "node scripts/stamp-release-pins.mjs --check",

49 "demo:svg": "node scripts/gen-demo-svg.mjs",

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/cli.ts",

52 "lint": "eslint src",

53 "typecheck": "tsc --noEmit",

54 "test": "vitest run",

55 "bench:literal": "tsx bench/literal-search.bench.ts",

56 "bench:locate": "tsx bench/locate-quality.bench.ts",

57 "bench:semantic-ask": "tsx bench/semantic-ask.bench.ts",

58 "bench:ask": "tsx bench/ask-quality.bench.ts",

59 "bench:repos": "tsx bench/repo-harness/run.mjs",

60 "bench:lib-docs": "tsx bench/lib-docs-quality.bench.ts",

61 "bench:di": "tsx bench/di-quality.bench.ts",

62 "bench:layer-a": "pnpm run bench:locate && pnpm run bench:semantic-ask && pnpm run bench:ask && pnpm run bench:lib-docs"

63 },

64 "keywords": [

65 "code-graph",

66 "codebase-intelligence",

67 "ast",

68 "tree-sitter",

69 "mcp",

70 "ai-agents",

dist/chunk-CBPDYYIH.jsView file

Lines 1-27javascript

1import { findNodes } from './chunk-J7LKEB2R.js';

2import { extractLiteralNeedles, residualForSymbolSearch } from './chunk-EW2ZMFUC.js';

3import { stableStringify } from './chunk-ZMSTSEGR.js';

4import { hashString } from './chunk-JFGYT6BI.js'

dist/chunk-IS7VTH2Q.jsView file

Lines 539-579javascript

539 run(command, options) {

540 const roots = writableRoots.length ? writableRoots : [options.cwd];

541 if (!roots.some((r)

dist/chunk-KYRH3567.jsView file

Lines 173-213javascript

173 async embed(texts) {

174 const out = [];

175 for await (const batch of model.embed(texts, 64)) {

dist/cli.jsView file

28import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftS... ... L58: import { Command, CommanderError, O

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L28

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L28

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-CBPDYYIH.jsView file

7import * as os from 'os'; L8: import { execFileSync, spawnSync } from 'child_process'; L9: import { Worker } from 'worker_threads';

High

Child Process

Package source references child process execution.

dist/chunk-CBPDYYIH.jsView on unpkg · L7

dist/chunk-IS7VTH2Q.jsView file

559cwd: options.cwd, L560: shell: true, L561: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/chunk-IS7VTH2Q.jsView on unpkg · L559

dist/chunk-KYRH3567.jsView file

193try { L194: const req = createRequire(path2.join(hostDir, "package.json")); L195: const mod = await import(pathToFileURL(req.resolve("fastembed")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-KYRH3567.jsView on unpkg · L193

dist/cli.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L28

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L28

28Trigger-reachable chain: manifest.bin -> dist/cli.js L28: import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeD

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L28

•matchType = previous_version_dangerous_delta matchedPackage = @vibgrate/cli@2026.806.1 matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.806.1 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

58import { Command, CommanderError, Option } from 'commander'; L59: import { execSync, spawn, spawnSync, execFileSync } from 'child_process'; L60: import * as os from 'os'; ... L255: try { L256: const raw = JSON.parse(fs11.readFileSync(verdictPath(dir), "utf8")); L257: if (raw?.status !== "ok" && raw?.status !== "crashed") return null; ... L4902: } L4903: function listOpenAiModels(baseUrl, inject) { L4904: if (inject) return inject(baseUrl);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.jsView on unpkg · L58

28Cross-file remote execution chain: dist/cli.js spawns dist/chunk-D2VEJHPC.js; helper contains network access plus dynamic code execution. L28: import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositor

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L28

28Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.js L28: import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCo

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L28

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L28

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

Findings

4 Critical6 High6 Medium7 Low

CriticalCredential Exfiltrationdist/cli.js

CriticalCommand Output Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-CBPDYYIH.js

HighShelldist/chunk-IS7VTH2Q.js

HighRemote Agent Bridgedist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-KYRH3567.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulegrammars/tree-sitter-go.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @vibgrate/cli@2026.806.2.

See version security history for other recorded verdicts.

Review the evidence and your use of @vibgrate/cli@2026.806.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-06 14:18:52.760Z (UTC).

90%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorVibgrate

Maintainersvibgrate-ops

Version2026.806.2

Latest on npm2026.1007.1

PublishedAug 6, 2026

LicenseApache-2.0

Dependencies21

Integrityverified

Package size5.99 MB

Files215

Keywordscode-graphcodebase-intelligenceasttree-sittermcpai-agentsdriftdeterministic

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → vg, vibgrate

Runtimenode >=22.0.0

Artifact52.2 MB · 215 files1 signature(s) · provenance

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellHighEntropyStringsObfuscatedTelemetryUrlStringsManifest: clean