registry / Remote code execution / bravecode-cli / 0.1.56

bravecode-cli@0.1.56

Agentic AI vibe coding CLI with free model support

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a serious, user-triggered remote agent execution vulnerability rather than evidence of install-time malware. The package has no active lifecycle mutation, but its default approval behavior does not match its execution path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Running an agent command such as bravecode run with a model response containing a tool call.

Impact

A compromised or malicious model endpoint can execute commands and modify local files in the CLI working environment.

Mechanism

Remote model-directed shell execution without enforced approval.

AI rationale

Evidence

package.jsondist/cli-main.mjs

Network endpoints1

codero.sohailsyed.com/api/chat

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

A remote model response is parsed into tool calls during a CLI session.
The default permission "ask" path only logs and then runs the requested tool.
The registered bash tool passes supplied commands directly to a shell.

Evidence against

The manifest postinstall hook is empty, so the included postinstall script is not invoked on installation.
The risky agent flow requires an explicit CLI chat or run action; auto-approval is an explicit option.
AGENTS.md creation is only under the explicit init command and refuses to overwrite an existing file.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

12 flagged

package.jsonView file

•dependencies registry_only=@opentui/core-darwin-arm64,@opentui/core-darwin-x64,@opentui/core-linux-arm64,@opentui/core-linux-arm64-musl,@opentui/core-linux-x64,@opentui/core-linux-x64-musl,@opentui/core-win32-arm64,@opentui/core-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli-main.mjsView file

1168var EventEmitter = __require("node:events").EventEmitter; L1169: var childProcess = __require("node:child_process"); L1170: var path2 = __require("node:path");

High

Child Process

Package source references child process execution.

dist/cli-main.mjsView on unpkg · L1168

2008} L2009: const execArgv = process2.execArgv ?? []; L2010: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/cli-main.mjsView on unpkg · L2008

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli-main.mjs: baseURL: "https://codero.sohailsyed.com/api", baseURL: "https://api.mistral.ai/v1", baseURL: "https://api.deepseek.com", baseURL: "https://openrouter.ai/api/v1", baseURL: "https://9router.com/v1", function isSameOrigin(url2, baseUrl) { return new URL(url2).origin === new URL(baseUrl).origin; message: `${description} API key must be a string.`

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli-main.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli-main.mjs: // node_modules/commander/lib/error.js "node_modules/commander/lib/error.js"(exports) { // node_modules/commander/lib/argument.js "node_modules/commander/lib/argument.js"(exports) { // node_modules/commander/lib/help.js "node_modules/commander/lib/help.js"(exports) { * Detect manually wrapped and indented strings by checking for line break followed by whitespace. * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli-main.mjsView on unpkg

58* Constructs the CommanderError class L59: * @param {number} exitCode suggested exit code which could be used with process.exit L60: * @param {string} code an id string representing the error ... L1168: var EventEmitter = __require("node:events").EventEmitter; L1169: var childProcess = __require("node:child_process"); L1170: var path2 = __require("node:path"); ... L1218: this._outputConfiguration = { L1219: writeOut: (str) => process2.stdout.write(str), L1220: writeErr: (str) => process2.stderr.write(str), ... L1257: * @returns {Command[]} L1258: * @private L1259: */

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli-main.mjsView on unpkg · L58

1168var EventEmitter = __require("node:events").EventEmitter; L1169: var childProcess = __require("node:child_process"); L1170: var path2 = __require("node:path"); ... L3892: name: "BraveCode AI", L3893: baseURL: "https://codero.sohailsyed.com/api", L3894: envKey: "BRAVECODE_API_KEY", ... L19895: } L19896: const content = fs.readFileSync(authPath, "utf8"); L19897: if (!content) { ... L30990: availableTools = void 0, L30991: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}` L30992: }) {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli-main.mjsView on unpkg · L1168

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: .log(` opened ${url2} in browser `); } catch (error40) { console.log(` could not open browser automatically.`); console.log(`please open this url manually: ${url2} `); } }); program2.command("fetch <url>").description("fetch content from a url").option("-m, --method <method>", "http method", "get").option("-d, --data <data>", "request body for post/put").action(async (url2, options2) => { const method = options2.method || "get"; console.log(` fetching ${url2} (${method})... `); try { const response = await fetch(url2, { method, headers: { "user-agent": "bravecode-ai/1.0" }, body: options2

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli-main.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = bravecode-cli@0.1.43 matchedPath = dist/cli-main.mjs matchedIdentity = npm:YnJhdmVjb2RlLWNsaQ:0.1.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-main.mjsView on unpkg

12import { createRequire as __braveCreateRequire } from 'module'; L13: const require = __braveCreateRequire(import.meta.url); L14: var __create = Object.create;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-main.mjsView on unpkg · L12

Source & flagged code

12 flagged · loading source

package.jsonView file

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli-main.mjsView file

Findings

1 Critical9 High5 Medium6 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli-main.mjs

HighShelldist/cli-main.mjs

HighCredential Redirect Persistencedist/cli-main.mjs

HighEntrypoint Foreign Package Code Overwritedist/cli-main.mjs

HighCloud Metadata Accessdist/cli-main.mjs

HighRemote Agent Bridgedist/cli-main.mjs

HighExternal Ai Agent Control Surface Mutationdist/cli-main.mjs

HighKnown Malware Source Similaritydist/cli-main.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Require

Affected versions and remediation

This report applies to bravecode-cli@0.1.56.

See all versions of bravecode-cli for other recorded verdicts.

Review the evidence and your use of bravecode-cli@0.1.56 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 01:24:45.181Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code