codiedev@0.9.58
Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe source shows no install-time data collection or unrelated credential destination. Network use, runtime installation, and agent configuration serve the package’s stated features and are triggered by its commands.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Users run codiedev connect to configure agent capture, or run codie to launch the harness.
Impact
Observed network use and user-level configuration changes serve the package’s stated features; no unrelated collection or harmful action was identified.
Mechanism
The CLI connects to Codiedev services; codie uses its configured key with the Codiedev gateway and installs the opencode-ai runtime when needed. Agent capture setup is initiated by connect.
AI rationale
The source shows no install-time data collection or unrelated credential destination. Network use, runtime installation, and agent configuration serve the package’s stated features and are triggered by its commands.
Evidence
~/.codiedev/config.json~/.claude/settings.json~/.claude/CLAUDE.md~/.codex/hooks.json~/.codex/AGENTS.md~/.config/opencode/plugins/codiedev.js
Network endpoints2
cli.codiedev.comgateway.codiedev.com/api/v1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install hook; its only lifecycle script is prepublishOnly, which runs during publishing.
- The CLI tells users that connect installs session capture for team sharing, and that command performs the agent setup.
- The harness requires a Codiedev key and defaults its gateway to gateway.codiedev.com.
- The harness uses a pinned opencode-ai runtime and installs it when the codie command needs it.
- The OpenCode metadata plugin says it sends session and Git identifiers plus skill names, not prompts, code, diffs, or tool output.
- The doctor sends the saved token as a bearer credential to the configured backend’s last-capture endpoint.
Evidence against
- The package installs agent capture hooks and writes user-level agent configuration, but this setup is performed by the explicit connect command.
- The harness launches a subprocess and may install its runtime, but those actions are tied to running codie and its stated purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
6 flaggeddist/hook.jsView file
43const http = __importStar(require("http"));
L44: const child_process_1 = require("child_process");
L45: const utils_1 = require("./utils");
High
dist/commands/reverseTicket.jsView file
12* caller pastes in. `parsePrOrMrUrl` only bounds those segments to "no slash",
L13: * so they can still carry `$(…)`, backticks or `;` — which a `shell: true`
L14: * invocation would execute. Passing argv directly means the shell never sees
High
dist/codie.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = codiedev@0.9.24
matchedIdentity = npm:Y29kaWVkZXY:0.9.24
similarity = 0.526
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical5 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/codie.js
HighChild Processdist/hook.js
HighShelldist/commands/reverseTicket.js
HighSandbox Evasion Gated Capabilitydist/codie.js
HighCross File Remote Execution Contextdist/utils.js
HighSemantic Analysis Limitedassets/git-refs.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codiedev@0.9.58.
See all versions of codiedev for other recorded verdicts.
- Review the evidence and your use of codiedev@0.9.58 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.