codiedev@0.9.62
Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package has a plausible team capture purpose, but this version also repairs Codex hooks automatically to enable per-prompt discovery. Because prompts are sent to the backend without separate disclosure of this behavior, this is a privacy risk that warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An existing `capture-codex` hook runs, repairs the Codex hook configuration, and subsequent `UserPromptSubmit` events invoke discovery.
Impact
Prompts may contain sensitive user input and are transmitted without a separate disclosure or consent for this discovery request.
Mechanism
The repair writes `discover-codex` into `~/.codex/hooks.json`; the handler posts the prompt as `q` to `${config.backendUrl}/api/cli/skill-discovery`.
AI rationale
The package has a plausible team capture purpose, but this version also repairs Codex hooks automatically to enable per-prompt discovery. Because prompts are sent to the backend without separate disclosure of this behavior, this is a privacy risk that warrants a warning.
Evidence
dist/hook.jsdist/utils.jsREADME.md~/.codex/hooks.json~/.codex/config.toml
Network endpoints2
${config.backendUrl}/api/cli/skill-discoverycli.codiedev.com (connect default; configurable via CODIEDEV_URL)
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The existing Codex capture hook calls a repair function, so the change can run without the user rerunning `connect`.
- That repair function adds a `discover-codex` hook to Codex `UserPromptSubmit` when it is missing.
- The discovery hook sends the prompt text as `q` to the configured backend’s `/api/cli/skill-discovery` endpoint.
- The hook handler passes `hookInput.prompt` into discovery automatically.
- The README describes session and transcript capture, but does not describe this separate per-prompt discovery request.
Evidence against
- The package’s stated purpose includes team session capture, and its README says transcripts are uploaded for server-side search.
- The request goes to the configured Codiedev backend and uses the package’s own connection token.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
6 flaggeddist/hook.jsView file
43const http = __importStar(require("http"));
L44: const child_process_1 = require("child_process");
L45: const utils_1 = require("./utils");
High
dist/commands/reverseTicket.jsView file
12* caller pastes in. `parsePrOrMrUrl` only bounds those segments to "no slash",
L13: * so they can still carry `$(…)`, backticks or `;` — which a `shell: true`
L14: * invocation would execute. Passing argv directly means the shell never sees
High
dist/codie.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = codiedev@0.9.24
matchedIdentity = npm:Y29kaWVkZXY:0.9.24
similarity = 0.526
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical5 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/codie.js
HighChild Processdist/hook.js
HighShelldist/commands/reverseTicket.js
HighSandbox Evasion Gated Capabilitydist/codie.js
HighCross File Remote Execution Contextdist/utils.js
HighSemantic Analysis Limitedassets/git-refs.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codiedev@0.9.62.
See all versions of codiedev for other recorded verdicts.
- Review the evidence and your use of codiedev@0.9.62 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.