@vibgrate/cli@2026.911.1: Suspicious npm security report (Warn)

Loading npm security reports…

@vibgrate/cli@2026.911.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

27 flagged

package.jsonView file

Lines 30-70json

30 "types": "./dist/index.d.ts",

31 "import": "./dist/index.js"

32 }

33 },

34 "files": [

35 "dist",

36 "grammars",

37 "skills",

38 "scripts/postinstall.mjs",

39 "LICENSE",

40 "NOTICE",

41 "README.md",

42 "DOCS.md"

43 ],

44 "scripts": {

45 "build": "pnpm run bundle:grammars && tsup",

46 "bundle:grammars": "node scripts/bundle-grammars.mjs",

47 "stamp:pins": "node scripts/stamp-release-pins.mjs",

48 "check:pins": "node scripts/stamp-release-pins.mjs --check",

49 "demo:svg": "node scripts/gen-demo-svg.mjs",

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/cli.ts",

52 "lint": "eslint src",

53 "typecheck": "tsc --noEmit",

54 "test": "vitest run",

55 "bench:suite": "tsx bench/build-suite.bench.ts",

56 "bench:literal": "tsx bench/literal-search.bench.ts",

57 "bench:locate": "tsx bench/locate-quality.bench.ts",

58 "bench:semantic-ask": "tsx bench/semantic-ask.bench.ts",

59 "bench:lib-docs": "tsx bench/lib-docs-quality.bench.ts",

60 "bench:di": "tsx bench/di-quality.bench.ts",

61 "bench:layer-a": "pnpm run bench:locate && pnpm run bench:semantic-ask && pnpm run bench:lib-docs",

62 "bench:vgd": "tsx bench/vgd-runtime.bench.ts"

63 },

64 "keywords": [

65 "code-graph",

66 "codebase-intelligence",

67 "ast",

68 "tree-sitter",

69 "mcp",

70 "ai-agents",

dist/chunk-EZ7UC5Y5.jsView file

Lines 1-23javascript

1import { __esm } from './chunk-Z6ZWNWWR.js';

2import * as fs from 'fs';

3import * as path from 'path';

dist/chunk-IS7VTH2Q.jsView file

Lines 539-579javascript

539 run(command, options) {

540 const roots = writableRoots.length ? writableRoots : [options.cwd];

541 if (!roots.some((r)

dist/fastembed-CXX7LSQ6.jsView file

Lines 1-39javascript

1import './chunk-Z6ZWNWWR.js';

2import * as fs from 'fs';

3import * as https from 'https';

4import

dist/chunk-3RS2NJMH.jsView file

Lines 1-31javascript

1import { parseGraph, stableStringify, serializeGraph } from './chunk-O3LABX6I.js';

2import { VERSION } from './chunk-5VQMGW3Z.js';

3import { globalGraphPathForRef, globalGraphPath, repositoryStoreDir } from './chunk-F4VMXLMV.js';

4import { detectGitRef } from './chunk-6XH7UYYR.js'

dist/cli.jsView file

44import { isRelevantChange } from './chunk-H53KDGTH.js'; L45: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L46: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftS... ... L51: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-NFUPH6WN.js'; L52: import { CliError, ExitCode, usageError, engineUnavailable, notFound } from './chunk-YYTT5YIN.js'; L53: import { resolveOne } from './chunk-J7LKEB2R.js'; ... L89: import { Command, CommanderError, Option } from

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L44

44Trigger-reachable chain: manifest.bin -> dist/cli.js L44: import { isRelevantChange } from './chunk-H53KDGTH.js'; L45: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L46: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftS... ... L51: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-NFUPH6WN.js'; L52: import { CliError, ExitCode, usageError, engineUnavailable, notFound } from './chunk-YYTT5YIN.js'; L53: import { resolveOne } from './chunk-J7LKEB2R.js'; ...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L44

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

dist/chunk-3RS2NJMH.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-3RS2NJMH.js#virtual:normalized:round1View on unpkg

dist/chunk-HUJZO4K5.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-HUJZO4K5.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-HUJZO4K5.jsView on unpkg

dist/chunk-JIP6DDZV.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-YVLVZK4W.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-JIP6DDZV.jsView on unpkg

dist/chunk-WUFIXAEJ.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-WUFIXAEJ.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WUFIXAEJ.jsView on unpkg

dist/chunk-26MBWVHL.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-6SYFLFQ3.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-26MBWVHL.jsView on unpkg

dist/chunk-VNDIF6D2.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-ZWS7NHQT.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-VNDIF6D2.jsView on unpkg

dist/chunk-XSFFEEZN.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-RUSJNIQS.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-XSFFEEZN.jsView on unpkg

dist/chunk-XXHST2AW.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-BOANUCAI.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-XXHST2AW.jsView on unpkg

dist/chunk-ZRPXTSMX.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-ZRPXTSMX.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZRPXTSMX.jsView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/chunk-W5IHRWRQ.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-IVD4OA3S.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-W5IHRWRQ.jsView on unpkg

dist/chunk-ZWUSCOFK.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-2AGBVXME.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZWUSCOFK.jsView on unpkg

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-EZ7UC5Y5.jsView file

3import * as path from 'path'; L4: import { execFileSync } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

dist/chunk-EZ7UC5Y5.jsView on unpkg · L3

dist/chunk-IS7VTH2Q.jsView file

559cwd: options.cwd, L560: shell: true, L561: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/chunk-IS7VTH2Q.jsView on unpkg · L559

dist/fastembed-CXX7LSQ6.jsView file

19try { L20: const req = createRequire(path.join(hostDir, "package.json")); L21: return await import(pathToFileURL(req.resolve(spec)).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/fastembed-CXX7LSQ6.jsView on unpkg · L19

dist/chunk-3RS2NJMH.jsView file

•matchType = normalized_sha256 matchedPackage = @vibgrate/cli@2026.910.3 matchedPath = dist/chunk-REYXILOS.js matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.910.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-3RS2NJMH.jsView on unpkg

11import { createHash } from 'crypto'; L12: import { spawnSync } from 'child_process'; L13: import { parse } from 'smol-toml'; L14: L15: var MAGIC = Buffer.from("VGSNAP1\0", "latin1"); L16: var crc322 = zlib.crc32 ?? jsCrc32; ... L298: function disabled() { L299: const v = process.env.VIBGRATE_NO_KERNEL; L300: return v === "1" || v === "true"; ... L302: function relevanceModuleDir() { L303: const base = process.env.XDG_CACHE_HOME || path8.join(os.homedir(), ".cache"); L304: return path8.join(base, "vibgrate", "modules", "relevance");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-3RS2NJMH.jsView on unpkg · L11

dist/cli.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L44

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L44

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

dist/chunk-3RS2NJMH.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-3RS2NJMH.js#virtual:normalized:round1View on unpkg

dist/chunk-HUJZO4K5.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-HUJZO4K5.jsView on unpkg

dist/chunk-JIP6DDZV.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-JIP6DDZV.jsView on unpkg

dist/chunk-WUFIXAEJ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WUFIXAEJ.jsView on unpkg

dist/chunk-26MBWVHL.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-26MBWVHL.jsView on unpkg

dist/chunk-VNDIF6D2.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-VNDIF6D2.jsView on unpkg

dist/chunk-XSFFEEZN.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-XSFFEEZN.jsView on unpkg

dist/chunk-XXHST2AW.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-XXHST2AW.jsView on unpkg

dist/chunk-ZRPXTSMX.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZRPXTSMX.jsView on unpkg

scripts/postinstall.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/chunk-W5IHRWRQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-W5IHRWRQ.jsView on unpkg

dist/chunk-ZWUSCOFK.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZWUSCOFK.jsView on unpkg

Source & flagged code

27 flagged

package.jsonView file

Lines 30-70json

30 "types": "./dist/index.d.ts",

31 "import": "./dist/index.js"

32 }

33 },

34 "files": [

35 "dist",

36 "grammars",

37 "skills",

38 "scripts/postinstall.mjs",

39 "LICENSE",

40 "NOTICE",

41 "README.md",

42 "DOCS.md"

43 ],

44 "scripts": {

45 "build": "pnpm run bundle:grammars && tsup",

46 "bundle:grammars": "node scripts/bundle-grammars.mjs",

47 "stamp:pins": "node scripts/stamp-release-pins.mjs",

48 "check:pins": "node scripts/stamp-release-pins.mjs --check",

49 "demo:svg": "node scripts/gen-demo-svg.mjs",

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/cli.ts",

52 "lint": "eslint src",

53 "typecheck": "tsc --noEmit",

54 "test": "vitest run",

55 "bench:suite": "tsx bench/build-suite.bench.ts",

56 "bench:literal": "tsx bench/literal-search.bench.ts",

57 "bench:locate": "tsx bench/locate-quality.bench.ts",

58 "bench:semantic-ask": "tsx bench/semantic-ask.bench.ts",

59 "bench:lib-docs": "tsx bench/lib-docs-quality.bench.ts",

60 "bench:di": "tsx bench/di-quality.bench.ts",

61 "bench:layer-a": "pnpm run bench:locate && pnpm run bench:semantic-ask && pnpm run bench:lib-docs",

62 "bench:vgd": "tsx bench/vgd-runtime.bench.ts"

63 },

64 "keywords": [

65 "code-graph",

66 "codebase-intelligence",

67 "ast",

68 "tree-sitter",

69 "mcp",

70 "ai-agents",

dist/chunk-EZ7UC5Y5.jsView file

Lines 1-23javascript

1import { __esm } from './chunk-Z6ZWNWWR.js';

2import * as fs from 'fs';

3import * as path from 'path';

dist/chunk-IS7VTH2Q.jsView file

Lines 539-579javascript

539 run(command, options) {

540 const roots = writableRoots.length ? writableRoots : [options.cwd];

541 if (!roots.some((r)

dist/fastembed-CXX7LSQ6.jsView file

Lines 1-39javascript

1import './chunk-Z6ZWNWWR.js';

2import * as fs from 'fs';

3import * as https from 'https';

4import

dist/chunk-3RS2NJMH.jsView file

Lines 1-31javascript

1import { parseGraph, stableStringify, serializeGraph } from './chunk-O3LABX6I.js';

2import { VERSION } from './chunk-5VQMGW3Z.js';

3import { globalGraphPathForRef, globalGraphPath, repositoryStoreDir } from './chunk-F4VMXLMV.js';

4import { detectGitRef } from './chunk-6XH7UYYR.js'

dist/cli.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L44

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L44

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

dist/chunk-3RS2NJMH.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-3RS2NJMH.js#virtual:normalized:round1View on unpkg

dist/chunk-HUJZO4K5.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-HUJZO4K5.jsView on unpkg

dist/chunk-JIP6DDZV.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-JIP6DDZV.jsView on unpkg

dist/chunk-WUFIXAEJ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WUFIXAEJ.jsView on unpkg

dist/chunk-26MBWVHL.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-26MBWVHL.jsView on unpkg

dist/chunk-VNDIF6D2.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-VNDIF6D2.jsView on unpkg

dist/chunk-XSFFEEZN.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-XSFFEEZN.jsView on unpkg

dist/chunk-XXHST2AW.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-XXHST2AW.jsView on unpkg

dist/chunk-ZRPXTSMX.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZRPXTSMX.jsView on unpkg

scripts/postinstall.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/chunk-W5IHRWRQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-W5IHRWRQ.jsView on unpkg

dist/chunk-ZWUSCOFK.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZWUSCOFK.jsView on unpkg

@vibgrate/cli@2026.911.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code