registry / AI-agent capability abuse / @yhong91/vibetime / 0.1.37

@yhong91/vibetime@0.1.37

vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi) and report activity to vibetime.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is an explicit-user-command agent-control and telemetry capability, not an unconsented npm lifecycle attack. The hard-coded non-TLS endpoint and broad agent-history collection justify a warning.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `vibetime install` and later agent hook events invoke `vibetime hook`.

Impact

Persistent agent integrations can transmit project/activity metadata and file-path/tool summaries to the configured remote service.

Mechanism

agent-hook persistence plus local-history telemetry upload

AI rationale

This is an explicit-user-command agent-control and telemetry capability, not an unconsented npm lifecycle attack. The hard-coded non-TLS endpoint and broad agent-history collection justify a warning.

Evidence

package.jsonbin/vibetime.mjs~/.vibetime/config.json~/.vibetime/session-context~/.vibetime/backfill-state.json~/.codex/hooks.json~/.claude/settings.json

Network endpoints2

121.196.224.82:3001/v3/agent/ingestregistry.npmjs.org/@yhong91/vibetime/latest

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

bin/vibetime.mjs explicitly installs hooks/plugins into Codex, Claude, OpenCode, and Pi configs.
Installed hooks launch `vibetime hook`, which starts a detached local sync runner.
Backfill reads agent session/history files and POSTs rollups to a hard-coded HTTP IP endpoint.
Uploaded rollups include project, tool names, display file paths, machine hostname, and token-backed headers.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
Config mutation requires the explicit `vibetime install` command; no import-time installation exists.
The npm install call is only reachable through the explicit `vibetime upgrade` command.
Source contains no remote-code loader, eval, credential harvesting, or destructive filesystem behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

4 flagged

bin/vibetime.mjsView file

Lines 105-145javascript

105 const entryPath = path3.join(rootPath, entry.name);

106 if (entry.isDirectory()) {

107 return listFilesByExtensions(entryPath, extensions);

108 }

109 return entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext)) ? [entryPath] : [];

110 }));

111 return files.flat().sort();

112}

113async function countDirectoryEntries(candidatePath) {

114 try {

115 const info = await stat(candidatePath);

116 if (!info.isDirectory()) {

117 if (candidatePath.endsWith(".jsonl")) {

118 const text = await readFile(candidatePath, "utf8");

119 return text.split("\n").filter(Boolean).length;

120 }

121 if (candidatePath.endsWith(".json")) {

122 return 1;

123 }

124 if (candidatePath.endsWith(".db")) {

125 try {

126 const { DatabaseSync } = await import("node:sqlite");

127 const db = new DatabaseSync(candidatePath, { readOnly: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vibetime.mjsView on unpkg · L125

128 try {

129 const result = db.prepare(

130 "SELECT count(*) as cnt FROM session WHERE time_created IS NOT NULL"

131 ).get();

132 return result?.cnt || 0;

133 } finally {

134 db.close();

135 }

136 } catch {

137 return 0;

138 }

139 }

140 return 1;

141 }

142 const files = await listFilesByExtensions(candidatePath, [".jsonl", ".json"]);

143 return files.length;

144 } catch (error) {

145 if (error.code === "ENOENT") {

Lines 865-905javascript

865 } else {

866 this.ondata(blk, false);

867 cpw(this.s.w, 0, blk.length);

868 this.s.w.set(blk, this.s.w.length

Lines 2402-2442javascript

2402 }

2403 });

2404 });

2405}

2406async function readLegacyAgyGeneratorMetadata(transcriptPath, sessionId) {

2407 const antigravityCliDir = path4.resolve(path4.dirname

Lines 11458-11498javascript

11458 write(ctx.stdout, "Checking npm registry...\n");

11459 const latest = await fetchLatestVersion();

11460 if (!latest) {

11461 write(ctx.stderr, "Could not fetch latest version from npm. Check your network connection.

Source & flagged code

4 flagged · loading source

bin/vibetime.mjsView file

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir5, open, rm, stat as stat13, writeFile as writeFile4 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2422// src/adapters/agy.ts L2423: var execAsync = promisify(exec); L2424: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2422

11478`); L11479: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], { L11480: stdio: "inherit" ... L11482: if (result.status !== 0) { L11483: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n"); L11484: return 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L11478

Findings

3 High4 Medium4 Low

HighChild Processbin/vibetime.mjs

HighShellbin/vibetime.mjs

HighRuntime Package Installbin/vibetime.mjs

MediumDynamic Requirebin/vibetime.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @yhong91/vibetime@0.1.37.

See all versions of @yhong91/vibetime for other recorded verdicts.

Review the evidence and your use of @yhong91/vibetime@0.1.37 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-27 20:57:07.058Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code