885// src/cli.ts
L886: import { spawn as spawn2, spawnSync } from "node:child_process";
L887: import { mkdir as mkdir6, open, rm, stat as stat16, writeFile as writeFile5 } from "node:fs/promises";
2486// src/adapters/agy.ts
L2487: var execAsync = promisify(exec);
L2488: var cachedRpcConnections = null;
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/vibetime.mjs:
import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
await writeFile(filePath, content, "utf8");
import { mkdir as mkdir6, open, rm, stat as stat16, writeFile as writeFile5 } from "node:fs/promises";
import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8");
await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8");
const override = env?.CLAUDE_CONFIG_DIR;
return path7.join(home, ".claude");
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
bin/vibetime.mjsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
bin/vibetime.mjs:
import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
await writeFile(filePath, content, "utf8");
// ../../node_modules/.pnpm/fzstd@0.1.1/node_modules/fzstd/esm/index.mjs
"../../node_modules/.pnpm/fzstd@0.1.1/node_modules/fzstd/esm/index.mjs"() {
import { mkdir as mkdir6, open, rm, stat as stat16, writeFile as writeFile5 } from "node:fs/promises";
// ../../node_modules/.pnpm/cac@7.0.0/node_modules/cac/dist/index.js
import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8");
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
bin/vibetime.mjsView on unpkg 15461`);
L15462: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], {
L15463: stdio: "inherit"
...
L15465: if (result.status !== 0) {
L15466: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n");
L15467: return 1;
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
bin/vibetime.mjsView on unpkg · L15461 •matchType = normalized_sha256
matchedPackage = @yhong91/vibetime@0.1.51
matchedPath = bin/vibetime.mjs
matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.51
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vibetime.mjsView on unpkg •matchType = malicious_source_fingerprint_signature
signature = d7fa548b32f50881
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @yhong91/vibetime@0.1.51
matchedPath = bin/vibetime.mjs
matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.51
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
HighKnown Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/vibetime.mjsView on unpkg 125try {
L126: const { DatabaseSync } = await import("node:sqlite");
L127: const db = new DatabaseSync(candidatePath, { readOnly: true });
MediumDynamic Require
Package source references dynamic require/import behavior.
bin/vibetime.mjsView on unpkg · L125