Loading npm security reports…

@yhong91/vibetime@0.1.51: Malicious npm security report (Block) | LPM Firewall

registry / @yhong91/vibetime / 0.1.51

@yhong91/vibetime@0.1.51

vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi) and report activity to vibetime.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The CLI installs persistent hooks into supported AI-agent configurations, then automatically imports local agent histories and uploads activity telemetry to a hard-coded IP endpoint. This is not triggered during npm installation, but follows an explicit setup command and later agent events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs vibetime install or upgrade, then uses an integrated AI agent.

Impact

External receiver obtains machine identity plus project, session, tool, token-usage, activity, and file-name metadata.

Mechanism

persistent AI-agent hooks trigger background telemetry exfiltration

Attack narrative

After explicit setup, generated hooks invoke vibetime on broad AI-agent lifecycle events. The CLI starts a detached local importer that reads supported agent histories, aggregates them, and POSTs telemetry to a hard-coded IP address by default. Although it avoids raw prompt content in the inspected rollup path, the automatic collection and upload of detailed agent/workspace metadata creates a concrete surveillance and data-exfiltration channel.

Rationale

Source confirms persistent agent-hook installation and default outbound collection to a hard-coded non-domain endpoint. The lack of an npm lifecycle hook reduces install-time risk but does not remove the concrete post-setup exfiltration behavior.

Evidence

package.jsonbin/vibetime.mjs~/.claude/settings.json~/.vibetime/config.json~/.vibetime/sync-local-trigger.json~/.vibetime/backfill-state.json

Source & flagged code

7 flagged · loading source

bin/vibetime.mjsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. bin/vibetime.mjs: return extensions.some((ext) => rootPath.endsWith(ext)) ? [rootPath] : []; return entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext)) ? [entryPath] : []; if (candidatePath.endsWith(".jsonl")) { if (candidatePath.endsWith(".json")) { if (candidatePath.endsWith(".db")) { "session.ended", "agent.ended", "subagent.ended",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/vibetime.mjsView on unpkg

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir5, open, rm, stat as stat13, writeFile as writeFile4 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2478// src/adapters/agy.ts L2479: var execAsync = promisify(exec); L2480: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2478

12439`); L12440: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], { L12441: stdio: "inherit" ... L12443: if (result.status !== 0) { L12444: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n"); L12445: return 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L12439

•matchType = normalized_sha256 matchedPackage = @yhong91/vibetime@0.1.50 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7fa548b32f50881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yhong91/vibetime@0.1.50 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.50 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg

125try { L126: const { DatabaseSync } = await import("node:sqlite"); L127: const db = new DatabaseSync(candidatePath, { readOnly: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vibetime.mjsView on unpkg · L125

Source & flagged code

7 flagged

bin/vibetime.mjsView file

Lines 105-145javascript

105 const entryPath = path3.join(rootPath, entry.name);

106 if (entry.isDirectory()) {

107 return listFilesByExtensions(entryPath, extensions);

108 }

109 return entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext)) ? [entryPath] : [];

110 }));

111 return files.flat().sort();

112}

113async function countDirectoryEntries(candidatePath) {

114 try {

115 const info = await stat(candidatePath);

116 if (!info.isDirectory()) {

117 if (candidatePath.endsWith(".jsonl")) {

118 const text = await readFile(candidatePath, "utf8");

119 return text.split("\n").filter(Boolean).length;

120 }

121 if (candidatePath.endsWith(".json")) {

122 return 1;

123 }

124 if (candidatePath.endsWith(".db")) {

125 try {

126 const { DatabaseSync } = await import("node:sqlite");

127 const db = new DatabaseSync(candidatePath, { readOnly: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vibetime.mjsView on unpkg · L125

128 try {

129 const result = db.prepare(

130 "SELECT count(*) as cnt FROM session WHERE time_created IS NOT NULL"

131 ).get();

132 return result?.cnt || 0;

133 } finally {

134 db.close();

135 }

136 } catch {

137 return 0;

138 }

139 }

140 return 1;

141 }

142 const files = await listFilesByExtensions(candidatePath, [".jsonl", ".json"]);

143 return files.length;

144 } catch (error) {

145 if (error.code === "ENOENT") {

Lines 865-905javascript

865 } else {

866 this.ondata(blk, false);

867 cpw(this.s.w, 0, blk.length);

868 this.s.w.set(blk, this.s.w.length

Lines 2458-2498javascript

2458 }

2459 });

2460 });

2461}

2462async function readLegacyAgyGeneratorMetadata(transcriptPath, sessionId) {

2463 const antigravityCliDir = path4.resolve(path4.dirname

Lines 12419-12459javascript

12419 write(ctx.stdout, "Checking npm registry...\n");

12420 const latest = await fetchLatestVersion();

12421 if (!latest) {

12422 write(ctx.stderr, "Could not fetch latest version from npm. Check your network connection.

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. bin/vibetime.mjs: return extensions.some((ext) => rootPath.endsWith(ext)) ? [rootPath] : []; return entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext)) ? [entryPath] : []; if (candidatePath.endsWith(".jsonl")) { if (candidatePath.endsWith(".json")) { if (candidatePath.endsWith(".db")) { "session.ended", "agent.ended", "subagent.ended",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/vibetime.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @yhong91/vibetime@0.1.50 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7fa548b32f50881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yhong91/vibetime@0.1.50 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.50 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg