registry / Remote code execution / bravecode-cli
bravecode-cli
Agentic AI vibe coding CLI with free model support
This report shows the evidence for bravecode-cli@0.1.43. 1 of 25 known versions is blocked or flagged. The newest version, 0.1.57, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe bundled runtime gives a fixed remote service control over local tools while bypassing the stated approval gate and returning tool output to that service. The empty install hook does not mitigate this user-triggered remote code execution and data-exfiltration path.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the BraveCode CLI with its default provider.
Impact
Remote code execution, arbitrary file reads, and credential or project-data exfiltration.
Mechanism
Remote tool-call execution with result forwarding.
Attack narrative
The CLI sends conversations to a fixed remote provider. That provider can return specially formatted tool calls, which the client parses and executes even when its permission system says approval is required. It can request arbitrary local file reads or shell commands, and the resulting data is added to the next remote conversation. This creates a direct remote-controlled execution and exfiltration channel whenever the CLI is used.
AI rationale
The bundled runtime gives a fixed remote service control over local tools while bypassing the stated approval gate and returning tool output to that service. The empty install hook does not mitigate this user-triggered remote code execution and data-exfiltration path.
Evidence
dist/cli-main.mjs
Network endpoints1
codero.sohailsyed.com/api
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The bundled default provider targets codero.sohailsyed.com and posts conversation data there.
- Server response text is parsed into tool calls.
- Calls marked as requiring approval are still executed without waiting for approval.
- Tool results are put back into the conversation and sent to the remote provider, enabling file-data exfiltration.
- The remote provider can invoke unrestricted file reads and shell commands through registered tools.
Evidence against
- The manifest postinstall hook is empty, so no install-time code runs.
- The remote control path is activated when the user runs the CLI, not merely by installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•dependencies registry_only=@opentui/core-darwin-arm64,@opentui/core-darwin-x64,@opentui/core-linux-arm64,@opentui/core-linux-arm64-musl,@opentui/core-linux-x64,@opentui/core-linux-x64-musl,@opentui/core-win32-arm64,@opentui/core-win32-x64
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg•scripts.postinstall =
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall =
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/core/snapshot/index.jsView file
Findings
4 Critical10 High5 Medium5 Low
CriticalBrowser Credential Phishingdist/cli-main.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli-main.mjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/core/snapshot/index.js
HighShelldist/cli-main.mjs
HighCredential Redirect Persistencedist/cli-main.mjs
HighEntrypoint Foreign Package Code Overwritedist/cli-main.mjs
HighCloud Metadata Accessdist/cli-main.mjs
HighRemote Agent Bridgedist/cli-main.mjs
High
Affected versions and remediation
This report applies to bravecode-cli@0.1.43.
The versions list below shows the verdict for each recorded version.
- Avoid installing bravecode-cli@0.1.43. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.