registry / cyberneurova-cli / 0.20.0
cyberneurova-cli@0.20.0
The CyberNeurova terminal AI coding agent
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential flow is consistent with provider-specific configuration, including a CyberNeurova key sent to the vendor's API. The package has no install lifecycle hook, and the inspected download-and-run command points to the vendor's own installer.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The package runs when a user invokes its CLI; no install hook is declared.
Impact
No unauthorized credential transfer or other attack impact was established.
Mechanism
Inspected credentials are mapped to their named providers, and the CyberNeurova API-key provider targets the vendor's service.
AI rationale
The flagged credential flow is consistent with provider-specific configuration, including a CyberNeurova key sent to the vendor's API. The package has no install lifecycle hook, and the inspected download-and-run command points to the vendor's own installer.
Network endpoints2
api.cyberneurova.aicyberneurova.ai
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/main.mjs as the CLI entry point and declares no install lifecycle hook.
- Provider configuration maps Anthropic, OpenAI, CyberNeurova and Google keys to their corresponding provider types.
- The CyberNeurova API-key provider uses the package vendor's API endpoint.
- The native updater command references the vendor's own install script.
Evidence against
- The bundled source includes cloud metadata addresses, but the inspected references are in bundled cloud SDK code; no automatic metadata collection flow was identified.
- A download-and-run shell command is constructed for the vendor's install script, but no install-time invocation was identified.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
11 flaggeddist/main.mjsView file
5const __dirname = __cjsShimDirname(__filename);
L6: import{createRequire as e}from"node:module";import*as t from"pathe";import n,{basename as r,dirname as i,isAbsolute as a,join as o,normalize as s,parse as c,relative as l,resolve a...
L7: `):[]}};Gi=new WeakMap,Ki=new WeakMap,qi.NEWLINE_CHARS=new Set([`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/main.mjsView on unpkg · L5•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/main.mjs:
import{createRequire as e}from"node:module";import*as t from"pathe";import n,{basename as r,dirname as i,isAbsolute as a,join as o,normalize as s,parse as c,relative as l,resolve a...
`)}\n${a}\n${t}`)}return a})(ha);var va=class extends fa{create(e,t){let{betas:n,...r}=e;return this._client.post(`/v1/environments?beta=true`,{body:r,...t,headers:ma([{"anthropic-...
Wrap your summary in <summary></summary> tags.`,a=W(this,_o,`f`).params.messages;if(a[a.length-1].role===`assistant`){let e=a[a.length-1];if(Array.isArray(e.content)){let t=e.conte...
`);this.baseURL=a.baseURL,this._baseURLIsExplicit=i.__baseURLIsExplicit??!!e
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/main.mjsView on unpkgFindings
1 Critical7 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist-web/assets/flowDiagram-I6XJVG4X-Bvqxq_92.js
HighSame File Env Network Executiondist/main.mjs
HighCredential Redirect Persistencedist/main.mjs
HighCommand Output Exfiltrationdist/main.mjs
HighCloud Metadata Accessdist/main.mjs
HighTrigger Reachable Command Output Exfiltrationdist/main.mjs
HighSemantic Analysis Limiteddist-web/assets/CodeBlockNode-B8Y2oNuu.js
HighKnown Malware Source Similaritydist-web/assets/chunk-AQP2D5EJ-Dkgu36A1.js
MediumDynamic Requiredist/main.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source File
Affected versions and remediation
This report applies to cyberneurova-cli@0.20.0.
See all versions of cyberneurova-cli for other recorded verdicts.
- Review the evidence and your use of cyberneurova-cli@0.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.