codiedev@0.9.22
Connect Claude Code, Codex, Cursor, or VS Code Copilot to Codiedev for org-wide session capture and artifact collaboration
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found high-sensitivity behavior, but it is disclosed, user-invoked, and aligned with the package's stated session-capture/artifact-sharing purpose. I did not find lifecycle execution, hidden payloads, credential exfiltration to unrelated endpoints, or unconsented AI-agent control mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `codiedev connect`, then configured agent hooks run during Claude/Codex/Cursor sessions.
Impact
Session transcripts and selected Markdown artifacts are sent to the user's configured Codiedev workspace after connection.
Mechanism
disclosed agent hook installation and authenticated session/artifact upload
AI rationale
Static inspection found high-sensitivity behavior, but it is disclosed, user-invoked, and aligned with the package's stated session-capture/artifact-sharing purpose. I did not find lifecycle execution, hidden payloads, credential exfiltration to unrelated endpoints, or unconsented AI-agent control mutation.
Evidence
package.jsonREADME.mddist/connect.jsdist/utils.jsdist/hook.jsdist/backup/run.jsdist/backup/match.jsdist/commands/shared.jsdist/commands/push.js~/.codiedev/config.json~/.claude/settings.json~/.claude/CLAUDE.md~/.codex/hooks.json~/.codex/AGENTS.md~/.cursor/hooks.json~/.cursor/rules/codiedev.mdc
Network endpoints5
cli.codiedev.com/api/cli/validateTokencli.codiedev.com/api/cli/markInstalledcli.codiedev.com/api/captureSessioncodiedev.com/portal/integrations/claude-coderegistry.npmjs.org/codiedev/latest
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- User-invoked `codiedev connect` writes agent hooks/instructions under `~/.claude`, `~/.codex`, and `~/.cursor` in `dist/connect.js` and `dist/utils.js`.
- Installed hooks read session transcripts and upload base64 transcript payloads to the configured Codiedev backend in `dist/hook.js`.
- Auto-backup hook scans git artifact Markdown files and privately pushes matched files in `dist/backup/run.js`.
Evidence against
- No install-time execution: `package.json` only has `prepublishOnly`, no npm install hooks.
- Hook/instruction writes occur from explicit `codiedev connect`, and README/CLI help disclose session capture and hook installation.
- Network endpoints are package-aligned Codiedev APIs: default `https://cli.codiedev.com` plus user-configured `CODIEDEV_URL`.
- `child_process` use is for git/agent hook subprocesses and detached local upload workers, not arbitrary downloaded code execution.
- `dist/backup/match.js` Unicode finding is a BOM-tolerant regex artifact, not hidden control-flow manipulation.
- No credential harvesting beyond prompting/storing the user's Codiedev token for authenticated API calls.
Source & flagged code
4 flaggeddist/hook.jsView file
42const http = __importStar(require("http"));
L43: const child_process_1 = require("child_process");
L44: const utils_1 = require("./utils");
High
dist/backup/match.jsView file
20contains invisible/control Unicode U+FEFF (zero width no-break space)
const m = md.match(/^<U+FEFF>?---\s*\n([\s\S]*?)\n---/);
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/backup/match.jsView on unpkg · L20•Trigger-reachable chain: manifest.bin -> dist/hook.js -> dist/backup/run.js -> dist/backup/match.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 High3 Medium5 Low
CriticalTrojan Source Unicodedist/backup/match.js
CriticalTrigger Reachable Dangerous Capabilitydist/backup/match.js
HighChild Processdist/hook.js
HighShell
HighCross File Remote Execution Contextdist/utils.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codiedev@0.9.22.
See all versions of codiedev for other recorded verdicts.
- Review the evidence and your use of codiedev@0.9.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.