codiedev@0.9.24
Connect Claude Code, Codex, Cursor, or VS Code Copilot to Codiedev for org-wide session capture and artifact collaboration
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe risky primitives are package-aligned, token-gated, and activated by an explicit connect flow rather than install/import-time execution. I found no credential harvesting beyond the user-provided API token, no hidden lifecycle execution, and no unconsented AI-agent control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs codiedev connect, then installed agent hooks invoke codiedev-hook during sessions.
Impact
Session transcripts and selected markdown artifacts may be uploaded to Codiedev as the advertised product behavior.
Mechanism
user-consented session capture and artifact backup hooks
AI rationale
The risky primitives are package-aligned, token-gated, and activated by an explicit connect flow rather than install/import-time execution. I found no credential harvesting beyond the user-provided API token, no hidden lifecycle execution, and no unconsented AI-agent control-surface mutation.
Evidence
package.jsondist/connect.jsdist/hook.jsdist/utils.jsdist/backup/run.jsdist/backup/match.js~/.codiedev/config.jsonagent hook/config files for Claude Code, Codex, Cursor, VS Code
Network endpoints2
cli.codiedev.comcodiedev.com
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install/postinstall hook; prepublishOnly is build-only and not run for consumers.
- Entrypoints are explicit CLIs: codiedev and codiedev-hook, with connect prompting for a Codiedev token.
- dist/connect.js validates token against cli.codiedev.com before saving ~/.codiedev/config.json and installing hooks.
- dist/hook.js reads configured token and posts session/transcript events to configured backend as documented session capture behavior.
- dist/backup/run.js auto-backs up selected markdown artifact files only after hook installation and skips AGENTS.md/CLAUDE.md/README.md, .git, node_modules, dist, build.
- dist/backup/match.js contains a BOM-tolerant regex, not a Trojan Source control-flow trick.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/hook.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = codiedev@0.9.23
matchedIdentity = npm:Y29kaWVkZXY:0.9.23
similarity = 0.947
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/hook.jsView on unpkg42const http = __importStar(require("http"));
L43: const child_process_1 = require("child_process");
L44: const utils_1 = require("./utils");
High
dist/backup/match.jsView file
20contains invisible/control Unicode U+FEFF (zero width no-break space)
const m = md.match(/^<U+FEFF>?---\s*\n([\s\S]*?)\n---/);
Critical
Findings
3 Critical3 High3 Medium5 Low
CriticalTrojan Source Unicodedist/backup/match.js
CriticalTrigger Reachable Dangerous Capabilitydist/backup/match.js
CriticalPrevious Version Dangerous Deltadist/hook.js
HighChild Processdist/hook.js
HighShell
HighCross File Remote Execution Contextdist/utils.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codiedev@0.9.24.
See all versions of codiedev for other recorded verdicts.
- Review the evidence and your use of codiedev@0.9.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.