Loading npm security reports…

codev-ai@0.5.13: Malicious npm security report (Block) | LPM Firewall

registry / codev-ai / 0.5.13

codev-ai@0.5.13

CoDev — AI Coding Agent Hub. Install, configure, and manage multiple AI coding agents.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The CLI persists shims for AI-agent commands, then silently exports and uploads local agent conversations when those commands are run. Exported sessions include prompts, reasoning, tool calls, and tool results.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs codevhub install and later launches a shimmed agent command while logged in.

Impact

Sensitive source, credentials, command output, and AI-agent session data can be sent off-host without a separate upload action.

Mechanism

persistent command interception plus background conversation exfiltration

Attack narrative

The install flow creates shell/PATH shims for Claude, Codex, and OpenCode. Those shims route future agent launches through codevhub; each such launch spawns a detached upload daemon when authenticated. The daemon reads local agent session files, renders prompts, reasoning, tool invocations and outputs to Markdown, compresses them, and uploads them via backend-issued presigned URLs. This automatic upload behavior is not disclosed in the package README.

Rationale

This is a concrete, persistent data-exfiltration chain, not merely an AI-agent configuration feature. It activates after a user-selected install, but the subsequent collection and upload are automatic and undisclosed.

Evidence

package.jsonREADME.mddist/index.js~/.codev-hub/bin~/.zshrc~/.bashrc~/.bash_profile~/.codex/sessions

Network endpoints

Source & flagged code

10 flagged · loading source

dist/index.jsView file

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L496

496Trigger-reachable chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L496

39092function wrapAnsi(string, columns, options) { L39093: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L39094: }

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L39092

49478} L49479: function execAsync(file, args2, options = {}) { L49480: logDebug(`exec: ${file} ${args2.join(" ")}`, {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L49478

34228opts.filename = input; L34229: inBuffer = filetools.fs.readFileSync(input); L34230: } else { ... L34990: lines.push(""); L34991: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : ""; L34992: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :... ... L39097: import process3 from "node:process"; L39098: import { execFileSync } from "node:child_process"; L39099: import fs from "node:fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L34228

496Trigger-reachable persistence chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L496

45719// src/lib/const.ts L45720: var BASE_URL = atob("[redacted]="); L45721: var BACKEND_URL = `${BASE_URL}/codev-backend`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L45719

•matchType = normalized_sha256 matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1c590807f64489fa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L496

Source & flagged code

10 flagged

dist/index.jsView file

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L496

496Trigger-reachable chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L496

39092function wrapAnsi(string, columns, options) { L39093: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L39094: }

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L39092

49478} L49479: function execAsync(file, args2, options = {}) { L49480: logDebug(`exec: ${file} ${args2.join(" ")}`, {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L49478

34228opts.filename = input; L34229: inBuffer = filetools.fs.readFileSync(input); L34230: } else { ... L34990: lines.push(""); L34991: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : ""; L34992: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :... ... L39097: import process3 from "node:process"; L39098: import { execFileSync } from "node:child_process"; L39099: import fs from "node:fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L34228

496Trigger-reachable persistence chain: scripts.start -> dist/index.js L496: "use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L496

45719// src/lib/const.ts L45720: var BASE_URL = atob("[redacted]="); L45721: var BACKEND_URL = `${BASE_URL}/codev-backend`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L45719

•matchType = normalized_sha256 matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1c590807f64489fa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = codev-ai@0.5.11 matchedPath = dist/index.js matchedIdentity = npm:Y29kZXYtYWk:0.5.11 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

496"use strict"; L497: "production" !== process.env.NODE_ENV && (function() { L498: function defineDeprecationWarning(methodName, info) { ... L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L637: displayName ... L1486: ]; L1487: if (process.platform !== "win32") { L1488: module2.exports.push( ... L1634: } L1635: process14.exitCode = code || /* istanbul ignore next */ L1636: 0;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L496