registry / Data exfiltration / codev-ai
codev-ai
CoDev — AI Coding Agent Hub. Install, configure, and manage multiple AI coding agents.
This report shows the evidence for codev-ai@0.6.4. 14 of 18 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is concrete, automatic exfiltration of AI-agent conversation data, not merely an explicit upload feature. The lack of an install-time hook does not remove the runtime privacy impact.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Run codevhub with claude, codex, opencode, codev, or a default agent launch while logged in.
Impact
Private prompts, agent responses, and repository-derived conversation content can be sent off-device without a separate upload command or prompt.
Mechanism
Detached background collection and upload of conversation logs.
Attack narrative
After a supported agent launch, the CLI starts a detached upload daemon. It exports sessions from supported AI agents, renders them as Markdown, gzip-compresses the files, and uploads them using a signed remote URL. This runs automatically for logged-in users and the base service hostname is obscured with Base64.
AI rationale
This is concrete, automatic exfiltration of AI-agent conversation data, not merely an explicit upload feature. The lack of an install-time hook does not remove the runtime privacy impact.
Evidence
dist/index.js
Network endpoints1
netmind.viettel.vn/codev-backend
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI conceals its service host with Base64 decoding.
- Launching Claude, Codex, OpenCode, or CoDev starts an upload daemon automatically.
- The daemon exports local AI-agent sessions into Markdown files.
- It gzip-compresses those files and uploads them to a server-provided URL.
Evidence against
- There is no npm install or postinstall hook; the manifest only declares prepare.
- The upload path requires an existing logged-in session before the daemon runs.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Oversized source lightweight scan
dist/index.js2.52 MB file, sampled 256 KB
Source & flagged code
10 flagged · loading sourcedist/index.jsView file
39865function wrapAnsi(string, columns, options) {
L39866: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n");
L39867: }
High
50478}
L50479: function powershellSnippet(agents) {
L50480: const dir = "$HOME\\.codev-hub\\bin";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
delete opts.headers.authorization;
if (opts.auth && !options.headers.authorization) {
options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");
Utils.prototype.writeFileTo = function(path, content, overwrite, attr) {
Utils.prototype.writeFileToAsync = function(path, content, overwrite, attr, callback) {
filetools.writeFileTo(childName, content2, overwrite, fileAttr2);
filetools.writeFileTo(target, content, overwrite, fileAttr);
filetools.writeFileTo(entryName, content, overwrite, fileAttr);
High
Credential Redirect Persistence
Findings
9 High3 Medium6 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighRemote Agent Bridgedist/index.js
HighTrigger Reachable Persistencedist/index.js
HighBase64 Obscured Urldist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to codev-ai@0.6.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing codev-ai@0.6.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.