codiedev@0.9.77
Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness
AI Security Review
scanned 5d ago · by lpm-firewall-aiNo malicious credential flow was found: the doctor token goes to the configured Codiedev backend, and Anthropic key mentions are CI examples. However, connected session hooks automatically install or update team packs in agent CLIs, so the default agent-extension lifecycle warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A connected user starts an agent session; syncing runs in the background about hourly unless disabled with CODIEDEV_PACK_AUTOSYNC=0.
Impact
Team-assigned pack content can alter agent behavior and add hooks without a separate install command at that session start. No malicious payload or credential theft was identified.
Mechanism
The hook spawns `codiedev pack install --quiet`; the installer writes downloaded pack manifests into local plugin directories and invokes detected agent CLIs to install or update plugins.
AI rationale
No malicious credential flow was found: the doctor token goes to the configured Codiedev backend, and Anthropic key mentions are CI examples. However, connected session hooks automatically install or update team packs in agent CLIs, so the default agent-extension lifecycle warrants a warning.
Evidence
dist/hook.jsdist/packs/sync.jsdist/commands/pack.jsdist/packs/install.jsdist/packs/harnesses.jsdist/packs/paths.jsdist/commands/doctor.jspackage.json~/.codiedev/packs/plugins/<slug>/~/.codiedev/packs/portable/plugins/<slug>/~/.cursor/plugins/local/codiedev-<slug>/
Network endpoints1
cli.codiedev.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Connected session-start hooks launch a background pack sync; disconnected installs skip it.
- The default background action runs `codiedev pack install --quiet`; the package documents hourly syncing and an opt-out.
- Pack manifests are written to local plugin directories, then detected agent CLIs receive plugin install or update commands.
- The doctor command sends the Codiedev token to the configured backend's token-validation endpoint.
Evidence against
- The only lifecycle script is `prepublishOnly: tsc`; there is no install hook.
- Anthropic API key references are CI examples that pass the key to the Claude CLI, not to a Codiedev endpoint.
- The source does not show credentials being sent to a foreign host or unrelated code being executed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/piRuntime.jsView file
48const path = __importStar(require("path"));
L49: const child_process_1 = require("child_process");
L50: const codieRuntimeInstall_1 = require("./codieRuntimeInstall");
High
dist/selfUpdate.jsView file
298* The .ps1 shims missing from a Windows npm prefix. The IT kit deletes them so
L299: * PowerShell falls back to the .cmd shims, which run under the Restricted
L300: * execution policy Windows client machines default to; `npm i -g` puts them
High
dist/codie.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = codiedev@0.9.24
matchedIdentity = npm:Y29kaWVkZXY:0.9.24
similarity = 0.421
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical5 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/codie.js
HighChild Processdist/piRuntime.js
HighShelldist/selfUpdate.js
HighSandbox Evasion Gated Capabilitydist/codie.js
HighCross File Remote Execution Contextdist/utils.js
HighSemantic Analysis Limitedassets/git-refs.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codiedev@0.9.77.
See all versions of codiedev for other recorded verdicts.
- Review the evidence and your use of codiedev@0.9.77 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.