@yhong91/vibetime@0.1.74: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@yhong91/vibetime@0.1.74: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

bin/vibetime.mjsView file

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir6, open, rm, stat as stat18, writeFile as writeFile5 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2486// src/adapters/agy.ts L2487: var execAsync = promisify(exec); L2488: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2486

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/vibetime.mjs: import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises"; await writeFile(filePath, content, "utf8"); import { mkdir as mkdir6, open, rm, stat as stat18, writeFile as writeFile5 } from "node:fs/promises"; import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises"; await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); const override = env?.CLAUDE_CONFIG_DIR; return path7.join(home, ".claude");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/vibetime.mjsView on unpkg

16734`); L16735: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], { L16736: stdio: "inherit" ... L16738: if (result.status !== 0) { L16739: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n"); L16740: return 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L16734

•matchType = normalized_sha256 matchedPackage = @yhong91/vibetime@0.1.62 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.62 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7fa548b32f50881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yhong91/vibetime@0.1.62 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.62 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg

125try { L126: const { DatabaseSync } = await import("node:sqlite"); L127: const db = new DatabaseSync(candidatePath, { readOnly: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vibetime.mjsView on unpkg · L125

Source & flagged code

7 flagged

bin/vibetime.mjsView file

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir6, open, rm, stat as stat18, writeFile as writeFile5 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2486// src/adapters/agy.ts L2487: var execAsync = promisify(exec); L2488: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2486

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/vibetime.mjs: import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises"; await writeFile(filePath, content, "utf8"); import { mkdir as mkdir6, open, rm, stat as stat18, writeFile as writeFile5 } from "node:fs/promises"; import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises"; await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); const override = env?.CLAUDE_CONFIG_DIR; return path7.join(home, ".claude");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/vibetime.mjsView on unpkg

16734`); L16735: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], { L16736: stdio: "inherit" ... L16738: if (result.status !== 0) { L16739: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n"); L16740: return 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L16734

•matchType = normalized_sha256 matchedPackage = @yhong91/vibetime@0.1.62 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.62 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7fa548b32f50881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yhong91/vibetime@0.1.62 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.62 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg

125try { L126: const { DatabaseSync } = await import("node:sqlite"); L127: const db = new DatabaseSync(candidatePath, { readOnly: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vibetime.mjsView on unpkg · L125