Loading npm security reports…

codev-ai@0.5.12: Malicious npm security report (Block) | LPM Firewall

registry / codev-ai / 0.5.12

codev-ai@0.5.12

CoDev — AI Coding Agent Hub. Install, configure, and manage multiple AI coding agents.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Launching codevhub to run Claude, Codex, OpenCode, or CoDev silently starts a detached daemon. With an existing CoDev login, it reads local AI conversation histories and uploads them to a remote analysis backend.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs codevhub or its agent-routing commands while authenticated.

Impact

Exfiltration of prompts, agent responses, tool inputs/results, and code-related session content.

Mechanism

Detached automatic conversation-history collection and remote upload.

Attack narrative

The CLI hooks ordinary agent-launch paths to spawn `upload --daemon` detached with ignored stdio. The daemon, when authenticated, exports sessions from multiple third-party AI-agent stores, including message and tool content, then obtains an analysis-backend session and uploads compressed exports through backend-provided URLs. The README does not disclose this automatic collection; it frames upload as a separate command.

Rationale

This is concrete, unconsented exfiltration of sensitive local AI-agent conversation data, not merely a user-requested upload feature. The lack of npm install hooks does not mitigate the runtime data-theft path.

Evidence

package.jsonREADME.mddist/index.js~/.claude/projects~/.codex/sessions~/.local/share/opencode/opencode.db~/.codev-hub/auth.json~/.codev-hub/agent-logs~/.codev-hub/upload.lock

Source & flagged code

10 flagged · loading source

dist/index.jsView file

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L496

496Trigger-reachable chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L496

39092function wrapAnsi(string, columns, options) { L39093: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L39094: }

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L39092

49478} L49479: function execAsync(file, args2) { L49480: logDebug(`exec: ${file} ${args2.join(" ")}`, {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L49478

34228opts.filename = input; L34229: inBuffer = filetools.fs.readFileSync(input); L34230: } else { ... L34990: lines.push(""); L34991: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : ""; L34992: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :... ... L39097: import process3 from "node:process"; L39098: import { execFileSync } from "node:child_process"; L39099: import fs from "node:fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L34228

496Trigger-reachable persistence chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L496

45719// src/lib/const.ts L45720: var BASE_URL = atob("[redacted]="); L45721: var BACKEND_URL = `${BASE_URL}/codev-backend`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L45719

•matchType = normalized_sha256 matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1c590807f64489fa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L496

Source & flagged code

10 flagged

dist/index.jsView file

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L496

496Trigger-reachable chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L496

39092function wrapAnsi(string, columns, options) { L39093: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L39094: }

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L39092

49478} L49479: function execAsync(file, args2) { L49480: logDebug(`exec: ${file} ${args2.join(" ")}`, {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L49478

34228opts.filename = input; L34229: inBuffer = filetools.fs.readFileSync(input); L34230: } else { ... L34990: lines.push(""); L34991: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : ""; L34992: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :... ... L39097: import process3 from "node:process"; L39098: import { execFileSync } from "node:child_process"; L39099: import fs from "node:fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L34228

496Trigger-reachable persistence chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L496

45719// src/lib/const.ts L45720: var BASE_URL = atob("[redacted]="); L45721: var BACKEND_URL = `${BASE_URL}/codev-backend`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L45719

•matchType = normalized_sha256 matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1c590807f64489fa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L496