Loading npm security reports…

codev-ai@0.4.5: Malicious npm security report (Block) | LPM Firewall

registry / codev-ai / 0.4.5

codev-ai@0.4.5

CoDev — AI Coding Agent Hub. Install, configure, and manage multiple AI coding agents.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Launching codevhub's wrapped AI-agent commands silently starts a detached daemon that exports and uploads local conversation logs for authenticated users. This is undisclosed automatic data exfiltration, separate from the visible upload command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Run codevhub, codevhub claude, codevhub codex, codevhub opencode, or an unrecognized wrapped-agent command after CoDev authentication.

Impact

AI-agent conversation contents and local paths are sent to the vendor backend.

Mechanism

Detached authenticated export and upload of local conversation logs

Attack narrative

The CLI invokes spawnUploadDaemon before launching wrapped agents. If CoDev authentication exists, it detaches `codevhub upload --daemon`; that exports local conversation logs, identifies changed Markdown files, obtains upload credentials, gzip-compresses each file, and uploads it. The documented README describes agent configuration but not this automatic collection. The visible `upload` command does not make the automatic launches consented.

Rationale

Source confirms an undisclosed, automatic and detached upload path for local AI conversation content. No install-time hook is present, but runtime data exfiltration is concrete.

Evidence

package.jsonREADME.mddist/index.js~/.codev-hub/auth.json~/.codev-hub/upload.lock~/.codev-hub/last-upload.json

Network endpoints1

netmind.viettel.vn

Source & flagged code

7 flagged · loading source

dist/index.jsView file

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L916: } L917: function recursivelyFlushAsyncActWork(returnValue, resolve4, reject) { L918: var queue = ReactSharedInternals.actQueue; ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push(

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L496

496Trigger-reachable chain: manifest.bin -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L916: } L917: function recursivelyFlushAsyncActWork(returnValue, resolve4, reject) { L918: var queue = ReactSharedInternals.actQueue; ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push(

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L496

39092function wrapAnsi(string, columns, options) { L39093: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L39094: }

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L39092

48746var USE_SHELL = process.platform === "win32"; L48747: function execAsync(file, args2) { L48748: logDebug(`exec: ${file} ${args2.join(" ")}`, {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L48746

34228opts.filename = input; L34229: inBuffer = filetools.fs.readFileSync(input); L34230: } else { ... L34990: lines.push(""); L34991: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : ""; L34992: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :... ... L39097: import process3 from "node:process"; L39098: import { execFileSync } from "node:child_process"; L39099: import fs from "node:fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L34228

45714// src/lib/const.ts L45715: var BASE_URL = atob("[redacted]="); L45716: var BACKEND_URL = `${BASE_URL}/codev-backend`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L45714

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L916: } L917: function recursivelyFlushAsyncActWork(returnValue, resolve4, reject) { L918: var queue = ReactSharedInternals.actQueue; ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push(

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L496

Source & flagged code

7 flagged

dist/index.jsView file

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L916: } L917: function recursivelyFlushAsyncActWork(returnValue, resolve4, reject) { L918: var queue = ReactSharedInternals.actQueue; ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push(

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L496

496Trigger-reachable chain: manifest.bin -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L916: } L917: function recursivelyFlushAsyncActWork(returnValue, resolve4, reject) { L918: var queue = ReactSharedInternals.actQueue; ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push(

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L496

39092function wrapAnsi(string, columns, options) { L39093: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L39094: }

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L39092

48746var USE_SHELL = process.platform === "win32"; L48747: function execAsync(file, args2) { L48748: logDebug(`exec: ${file} ${args2.join(" ")}`, {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L48746

34228opts.filename = input; L34229: inBuffer = filetools.fs.readFileSync(input); L34230: } else { ... L34990: lines.push(""); L34991: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : ""; L34992: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :... ... L39097: import process3 from "node:process"; L39098: import { execFileSync } from "node:child_process"; L39099: import fs from "node:fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L34228

45714// src/lib/const.ts L45715: var BASE_URL = atob("[redacted]="); L45716: var BACKEND_URL = `${BASE_URL}/codev-backend`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L45714

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L916: } L917: function recursivelyFlushAsyncActWork(returnValue, resolve4, reject) { L918: var queue = ReactSharedInternals.actQueue; ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push(

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L496