@yhong91/vibetime@0.1.69
vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi, Cursor) and report activity to vibetime.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has a concrete, user-invoked agent-hook and activity-upload capability with a fixed unencrypted default endpoint. It lacks npm install lifecycle hooks, so the source supports a warning rather than a malware block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs vibetime install and subsequently uses an instrumented agent.
Impact
Agent activity metadata and the VibeTime token may be exposed to the configured service; the default transport is unencrypted HTTP.
Mechanism
User-installed agent hooks upload activity rollups to a configurable remote service.
AI rationale
The package has a concrete, user-invoked agent-hook and activity-upload capability with a fixed unencrypted default endpoint. It lacks npm install lifecycle hooks, so the source supports a warning rather than a malware block.
Evidence
bin/vibetime.mjs~/.codex/hooks.json
Network endpoints3
121.196.224.82:3001121.196.224.82:3001/v3/agent/ingestregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit install command writes VibeTime hook configuration into the Codex hooks file.
- The hook configuration can report activity to a default HTTP endpoint and includes the configured bearer token and machine metadata.
- The upgrade command performs a global npm installation only when the user runs the upgrade command.
Evidence against
- The manifest has no preinstall, install, or postinstall lifecycle hook.
- Configuration and hook installation are exposed as user-invoked CLI commands, not automatic package-install behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcebin/vibetime.mjsView file
885// src/cli.ts
L886: import { spawn as spawn2, spawnSync } from "node:child_process";
L887: import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises";
High
2486// src/adapters/agy.ts
L2487: var execAsync = promisify(exec);
L2488: var cachedRpcConnections = null;
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/vibetime.mjs:
import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
await writeFile(filePath, content, "utf8");
import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises";
import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8");
await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8");
const override = env?.CLAUDE_CONFIG_DIR;
return path7.join(home, ".claude");
Findings
6 High3 Medium4 Low
HighChild Processbin/vibetime.mjs
HighShellbin/vibetime.mjs
HighCredential Redirect Persistencebin/vibetime.mjs
HighRuntime Package Installbin/vibetime.mjs
HighKnown Malware Source Similaritybin/vibetime.mjs
HighKnown Malware Source Fingerprint Signaturebin/vibetime.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @yhong91/vibetime@0.1.69.
See all versions of @yhong91/vibetime for other recorded verdicts.
- Review the evidence and your use of @yhong91/vibetime@0.1.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.