registry / Credential exfiltration / @yhong91/vibetime

@yhong91/vibetime

vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi, Cursor) and report activity to vibetime.

This report shows the evidence for @yhong91/vibetime@0.1.76. 7 of 48 known versions are blocked or flagged. The newest version, 0.1.82, is flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source establishes an explicit-command persistence chain from broad AI-agent hooks to authenticated uploads at a hard-coded HTTP IP endpoint. The lack of an install lifecycle hook reduces automatic-install risk but does not remove the concrete exfiltration capability.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

The user runs vibetime install, then an installed AI-agent hook fires.

Impact

Agent activity and the configured bearer token can be disclosed to the operator of the fixed endpoint.

Mechanism

Persistent AI-agent hooks collect activity and send authenticated rollups to a hard-coded remote service.

Attack narrative

The CLI has no automatic npm lifecycle trigger, but its explicit install command modifies AI-agent hook configuration. Those hooks run vibetime when prompts, permissions, and tool events occur, start a background history import, and upload rollups using a saved bearer token. The remote defaults to an unauthenticated HTTP IP address rather than the advertised service domain, making this a concrete credential and activity-exfiltration path.

AI rationale

Evidence

package.jsonbin/vibetime.mjs~/.codex/hooks.json~/.vibetime/config.json~/.vibetime/machine-id~/.vibetime/backfill-state.json~/.vibetime/sync-local-trigger.json

Network endpoints1

121.196.224.82:3001/v3/agent/ingest

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The default service is a hard-coded HTTP endpoint at an unrelated IP address.
The explicit install command adds hooks for prompt, permission, and tool events to the user's Codex configuration.
Hook activation starts a background import that collects local agent history and uploads rollups.
Uploads include the saved bearer token and machine identity headers.
The package has no npm install lifecycle hook; its integration is activated by its CLI install command.

Evidence against

The manifest exposes only a CLI and has no preinstall, install, or postinstall script.
The hook installation path is an explicit user command rather than automatic package-install execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 592 KB of source, external domains: 121.196.224.82, cursor.com, registry.npmjs.org, vibetime.dev

Source & flagged code

6 flagged

bin/vibetime.mjsView file

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2489// src/adapters/agy.ts L2490: var execAsync = promisify(exec); L2491: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2489

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/vibetime.mjs: import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises"; await writeFile(filePath, content, "utf8"); import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises"; import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises"; await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); const override = env?.CLAUDE_CONFIG_DIR; return path7.join(home, ".claude");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/vibetime.mjsView on unpkg

16745`); L16746: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], { L16747: stdio: "inherit" ... L16749: if (result.status !== 0) { L16750: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n"); L16751: return 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L16745

•matchType = normalized_sha256 matchedPackage = @yhong91/vibetime@0.1.75 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.75 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7fa548b32f50881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yhong91/vibetime@0.1.75 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.75 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg

Source & flagged code

6 flagged · loading source

bin/vibetime.mjsView file

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2489// src/adapters/agy.ts L2490: var execAsync = promisify(exec); L2491: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2489

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/vibetime.mjsView on unpkg

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L16745

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg

Findings

6 High3 Medium4 Low

HighChild Processbin/vibetime.mjs

HighShellbin/vibetime.mjs

HighCredential Redirect Persistencebin/vibetime.mjs

HighRuntime Package Installbin/vibetime.mjs

HighKnown Malware Source Similaritybin/vibetime.mjs

HighKnown Malware Source Fingerprint Signaturebin/vibetime.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @yhong91/vibetime@0.1.76.

The versions list below shows the verdict for each recorded version.

Avoid installing @yhong91/vibetime@0.1.76. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-13 03:01:27.228Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

48 known versions

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages

Source & flagged code