Loading npm security reports…

@yhong91/vibetime@0.1.76: Malicious npm security report (Block) | LPM Firewall

registry / @yhong91/vibetime / 0.1.76

@yhong91/vibetime@0.1.76

vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi, Cursor) and report activity to vibetime.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Running the CLI install command writes agent hooks that invoke this package for prompt, permission, and tool events. The hooks trigger background collection of local agent history and upload it, with a persisted bearer token, to a fixed HTTP IP address.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

The user runs vibetime install, then an installed AI-agent hook fires.

Impact

Agent activity and the configured bearer token can be disclosed to the operator of the fixed endpoint.

Mechanism

Persistent AI-agent hooks collect activity and send authenticated rollups to a hard-coded remote service.

Attack narrative

The CLI has no automatic npm lifecycle trigger, but its explicit install command modifies AI-agent hook configuration. Those hooks run vibetime when prompts, permissions, and tool events occur, start a background history import, and upload rollups using a saved bearer token. The remote defaults to an unauthenticated HTTP IP address rather than the advertised service domain, making this a concrete credential and activity-exfiltration path.

AI rationale

Source establishes an explicit-command persistence chain from broad AI-agent hooks to authenticated uploads at a hard-coded HTTP IP endpoint. The lack of an install lifecycle hook reduces automatic-install risk but does not remove the concrete exfiltration capability.

Evidence

package.jsonbin/vibetime.mjs~/.codex/hooks.json~/.vibetime/config.json~/.vibetime/machine-id~/.vibetime/backfill-state.json~/.vibetime/sync-local-trigger.json

Source & flagged code

6 flagged · loading source

bin/vibetime.mjsView file

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2489// src/adapters/agy.ts L2490: var execAsync = promisify(exec); L2491: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2489

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/vibetime.mjs: import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises"; await writeFile(filePath, content, "utf8"); import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises"; import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises"; await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); const override = env?.CLAUDE_CONFIG_DIR; return path7.join(home, ".claude");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/vibetime.mjsView on unpkg

16745`); L16746: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], { L16747: stdio: "inherit" ... L16749: if (result.status !== 0) { L16750: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n"); L16751: return 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L16745

•matchType = normalized_sha256 matchedPackage = @yhong91/vibetime@0.1.75 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.75 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7fa548b32f50881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yhong91/vibetime@0.1.75 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.75 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg

Source & flagged code

6 flagged

bin/vibetime.mjsView file

885// src/cli.ts L886: import { spawn as spawn2, spawnSync } from "node:child_process"; L887: import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/vibetime.mjsView on unpkg · L885

2489// src/adapters/agy.ts L2490: var execAsync = promisify(exec); L2491: var cachedRpcConnections = null;

High

Shell

Package source references shell execution.

bin/vibetime.mjsView on unpkg · L2489

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/vibetime.mjs: import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises"; await writeFile(filePath, content, "utf8"); import { mkdir as mkdir6, open, rm, stat as stat17, writeFile as writeFile5 } from "node:fs/promises"; import { mkdir as mkdir2, readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises"; await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); await writeFile2(cacheFile, JSON.stringify(generatorMetadata, null, 2), "utf8"); const override = env?.CLAUDE_CONFIG_DIR; return path7.join(home, ".claude");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/vibetime.mjsView on unpkg

16745`); L16746: const result = spawnSync("npm", ["install", "-g", `${NPM_PACKAGE}@latest`], { L16747: stdio: "inherit" ... L16749: if (result.status !== 0) { L16750: write(ctx.stderr, "\nFailed to install update. Try manually: npm install -g @yhong91/vibetime@latest\n"); L16751: return 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/vibetime.mjsView on unpkg · L16745

•matchType = normalized_sha256 matchedPackage = @yhong91/vibetime@0.1.75 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.75 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/vibetime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7fa548b32f50881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yhong91/vibetime@0.1.75 matchedPath = bin/vibetime.mjs matchedIdentity = npm:QHlob25nOTEvdmliZXRpbWU:0.1.75 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/vibetime.mjsView on unpkg