registry / @yhong91/vibetime / 0.1.48

@yhong91/vibetime@0.1.48

vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi) and report activity to vibetime.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit CLI installation mutates supported AI-agent hook configuration, causing later agent events to invoke Vibetime. Those events trigger background metadata rollup uploads to the configured remote, defaulting to an HTTP IP address.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `vibetime install` or `vibetime upgrade`; installed agent hooks later fire.

Impact

Persistent agent-event collection and transmission of activity metadata, machine identity, and bearer token when configured.

Mechanism

User-invoked agent hook installation and telemetry upload

Rationale

The package is not malicious by source evidence: it has no lifecycle execution or stealth payload. Its explicit hook setup and automatic telemetry sync create a material, user-consented agent-extension lifecycle risk that warrants a warning.

Evidence

package.jsonbin/vibetime.mjs~/.codex/hooks.json~/.vibetime/config.json~/.vibetime/machine-id~/.vibetime/session-context/*.json~/.vibetime/backfill-state.json

Network endpoints2

121.196.224.82:3001/v3/agent/ingestregistry.npmjs.org/@yhong91/vibetime/latest

@yhong91/vibetime@0.1.48

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code