registry / AI-agent capability abuse / bravecode-cli / 0.1.18

bravecode-cli@0.1.18

Agentic AI vibe coding CLI with free model support

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The package's postinstall hook is empty, while its explicit init command writes a package-provided AGENTS.md that can affect project agents. This warrants a warning for user-invoked agent configuration mutation, but the inspected source does not establish malicious behavior or justify blocking publication.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user runs the bravecode init command.

Impact

The resulting project instructions can influence coding agents working in that project.

Mechanism

The command writes a package-provided AGENTS.md when one is absent and returns if the file already exists.

AI rationale

Evidence

dist/cli.jsAGENTS.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package has an empty postinstall hook; prepublishOnly runs the build.
The explicit init command creates AGENTS.md and skips an existing file unless the user acts to overwrite it.
The bundled CLI contains the same guarded init behavior.
The package can create project snapshots and check for updates when those features are used.
The MCP and browser tools expose configured commands and user-supplied URLs.
The share feature stores conversation messages locally, and web search queries DuckDuckGo.

Evidence against

The init command writes an agent instruction file in the current project, so it changes a control surface used by coding agents.
The inspected files show no automatic install-time AGENTS.md mutation or confirmed credential theft.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

Source & flagged code

17 flagged

package.jsonView file

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/snapshot/index.jsView file

1import { execSync } from "child_process"; L2: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/core/snapshot/index.jsView on unpkg · L1

dist/cli.mjsView file

1998} L1999: const execArgv = process2.execArgv ?? []; L2000: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L1998

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: baseURL: "https://codero.sohailsyed.com/api", baseURL: "https://api.mistral.ai/v1", baseURL: "https://api.deepseek.com", baseURL: "https://openrouter.ai/api/v1", baseURL: "https://9router.com/v1", function isSameOrigin(url2, baseUrl) { return new URL(url2).origin === new URL(baseUrl).origin; message: `${description} API key must be a string.`

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.mjs: // node_modules/commander/lib/error.js "node_modules/commander/lib/error.js"(exports) { // node_modules/commander/lib/argument.js "node_modules/commander/lib/argument.js"(exports) { // node_modules/commander/lib/help.js "node_modules/commander/lib/help.js"(exports) { * Detect manually wrapped and indented strings by checking for line break followed by whitespace. * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.mjsView on unpkg

dist/core/tui/ChatTUI.jsView file

2export function ChatTUI({ agentName, modelName, onMessage, onExit }) { L3: const React = require("react"); L4: const { useState, useEffect, useCallback } = React;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/tui/ChatTUI.jsView on unpkg · L2

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = bravecode-cli@0.1.57 matchedIdentity = npm:YnJhdmVjb2RlLWNsaQ:0.1.57 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: \n`); } catch (error) { console.log(`\ncould not open browser automatically.`); console.log(`please open this url manually: ${url}\n`); } }); program .command("fetch <url>") .description("fetch content from a url") .option("-m, --method <method>", "http method", "get") .option("-d, --data <data>", "request body for post/put") .action(async (url, options) => { const method = options.method || "get"; console.log(`\nfetching ${url} (${method})...\n`); try { const response = await fetch(url, { method, headers: { "user-agent": "bravecode-ai/1.0", }, body: options.data,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = bravecode-cli@0.1.43 matchedPath = dist/cli.js matchedIdentity = npm:YnJhdmVjb2RlLWNsaQ:0.1.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/core/update/index.jsView file

83console.log("Updating @bravecode/cli..."); L84: execSync("npm install -g @bravecode/cli@latest", { L85: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/update/index.jsView on unpkg · L83

•matchType = normalized_sha256 matchedPackage = bravecode-cli@0.1.43 matchedPath = dist/core/update/index.js matchedIdentity = npm:YnJhdmVjb2RlLWNsaQ:0.1.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High