bravecode-cli@0.1.19

Agentic AI vibe coding CLI with free model support

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Inspected source shows no malicious behavior. Scanner similarity hints are not supported by the reviewed code; the agent configuration write is explicit-command setup with an existing-file guard, and postinstall is empty.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user invokes the bravecode init command.

Impact

It adds project agent instructions at the user's request; no unconsented install-time agent configuration mutation was found.

Mechanism

The command creates an AGENTS.md in the current project directory only when one does not already exist.

AI rationale

Evidence

AGENTS.md.bravecode/snapshots~/.bravecode/shares~/.bravecode/last-update-check

Network endpoints1

html.duckduckgo.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to the CLI entrypoint and has an empty postinstall script; prepublishOnly only builds the package.
The AGENTS.md write is inside the explicit init command, and the command returns without overwriting an existing file.
The bundled CLI has the same existing-file guard at the indicated agent configuration location.
Snapshot and share code write package data under .bravecode; update and MCP behavior is ordinary update checking and configured process startup.
Browser and web search tools are invoked through their tool handlers and use supplied URLs or DuckDuckGo.

Evidence against

The CLI can create an AGENTS.md file containing agent instructions when a user runs init.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

20 flagged

package.jsonView file

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/snapshot/index.jsView file

1import { execSync } from "child_process"; L2: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/core/snapshot/index.jsView on unpkg · L1

dist/cli.mjsView file

1998} L1999: const execArgv = process2.execArgv ?? []; L2000: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L1998

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: baseURL: "https://codero.sohailsyed.com/api", baseURL: "https://api.mistral.ai/v1", baseURL: "https://api.deepseek.com", baseURL: "https://openrouter.ai/api/v1", baseURL: "https://9router.com/v1", function isSameOrigin(url2, baseUrl) { return new URL(url2).origin === new URL(baseUrl).origin; message: `${description} API key must be a string.`

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.mjs: // node_modules/commander/lib/error.js "node_modules/commander/lib/error.js"(exports) { // node_modules/commander/lib/argument.js "node_modules/commander/lib/argument.js"(exports) { // node_modules/commander/lib/help.js "node_modules/commander/lib/help.js"(exports) { * Detect manually wrapped and indented strings by checking for line break followed by whitespace. * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.mjsView on unpkg

dist/core/tui/ChatTUI.jsView file

2export function ChatTUI({ agentName, modelName, onMessage, onExit }) { L3: const React = require("react"); L4: const { useState, useEffect, useCallback } = React;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/tui/ChatTUI.jsView on unpkg · L2

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = bravecode-cli@0.1.57 matchedIdentity = npm:YnJhdmVjb2RlLWNsaQ:0.1.57 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: \n`); } catch (error) { console.log(`\ncould not open browser automatically.`); console.log(`please open this url manually: ${url}\n`); } }); program .command("fetch <url>") .description("fetch content from a url") .option("-m, --method <method>", "http method", "get") .option("-d, --data <data>", "request body for post/put") .action(async (url, options) => { const method = options.method || "get"; console.log(`\nfetching ${url} (${method})...\n`); try { const response = await fetch(url, { method, headers: { "user-agent": "bravecode-ai/1.0", }, body: options.data,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = bravecode-cli@0.1.43 matchedPath = dist/cli.js matchedIdentity = npm:YnJhdmVjb2RlLWNsaQ:0.1.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/core/update/index.jsView file

83console.log("Updating @bravecode/cli..."); L84: execSync("npm install -g @bravecode/cli@latest", { L85: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/update/index.jsView on unpkg · L83

•matchType = normalized_sha256 matchedPackage = bravecode-cli@0.1.43 matchedPath = dist/core/update/index.js matchedIdentity = npm:YnJhdmVjb2RlLWNsaQ:0.1.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High