registry / @yhong91/vibetime / 0.1.49

@yhong91/vibetime@0.1.49

vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi) and report activity to vibetime.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `vibetime install` (or `vibetime upgrade`), then an installed agent hook fires.

Impact

Agent-session-derived activity metadata, machine identifiers, and bearer authentication may be transmitted to the default remote service.

Mechanism

AI-agent hook installation and background telemetry upload

Rationale

Source inspection confirms an explicit-user-command AI-agent telemetry and control-surface integration with a risky default remote endpoint. It lacks lifecycle-triggered execution or a concrete covert payload, so warning is proportionate.

Evidence

package.jsonbin/vibetime.mjs~/.codex/hooks.json~/.claude/settings.json~/.opencode/plugins/vibetime.mjs~/.pi/agent/extensions/vibetime.ts~/.vibetime/config.json~/.vibetime/machine-id~/.vibetime/sync-local-trigger-state.json~/.vibetime/sync-local-trigger.lock

Network endpoints2

121.196.224.82:3001/v3/agent/ingest/@yhong91/vibetime/latest

@yhong91/vibetime@0.1.49

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code