registry / cyberneurova-cli / 0.20.1
cyberneurova-cli@0.20.1
The CyberNeurova terminal AI coding agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner signals are explained by a large bundled AI coding CLI with normal network, credential, subprocess, and filesystem features. Direct inspection found no lifecycle trigger or concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user explicitly runs the cyberneurova or neurova command and chooses a related feature.
Impact
The CLI can contact its vendor services and cache a helper binary, but inspection found no install-time or covert attack behavior.
Mechanism
User-invoked AI CLI, provider connection, and optional tool download.
AI rationale
The scanner signals are explained by a large bundled AI coding CLI with normal network, credential, subprocess, and filesystem features. Direct inspection found no lifecycle trigger or concrete malicious behavior.
Evidence
package.jsondist/main.mjs
Network endpoints2
cyberneurova.ai/cli/rg/${r}api.cyberneurova.ai/v1
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The CLI can download a checksum-verified ripgrep archive from the package vendor when its runtime fallback is used.
- The interactive provider feature has a first-party API endpoint and can handle user-supplied API keys.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The manifest exposes the code only as an explicitly invoked CLI binary.
- No source evidence showed credential theft, foreign package overwrite, stealth persistence, or automatic execution on installation.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings
Source & flagged code
12 flaggeddist-web/assets/index-CxRV4At0.jsView file
152?|[
L153: \v\f
\u2028\u2029])`),t));else if(l==="posix")if(!i&&(p==="graph"||p==="print")){if(r==="strict")throw new Error(`POSIX class "${p}" requires min target ES2024 or non-strict accura...
High
Child Process
Package source references child process execution.
dist-web/assets/index-CxRV4At0.jsView on unpkg · L152dist-web/assets/codeql-DsOJ9woJ.jsView file
1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1dist/main.mjsView file
Findings
1 Critical8 High7 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/main.mjs
HighChild Processdist-web/assets/index-CxRV4At0.js
HighSame File Env Network Executiondist/main.mjs
HighCredential Redirect Persistencedist/main.mjs
HighEntrypoint Foreign Package Code Overwritedist/main.mjs
HighCommand Output Exfiltrationdist/main.mjs
HighTrigger Reachable Command Output Exfiltrationdist/main.mjs
HighSemantic Analysis Limiteddist-web/assets/CodeBlockNode-B8Y2oNuu.js
HighKnown Malware Source Similaritydist-web/assets/cytoscape.esm-nFXppDBa.js
MediumDynamic Requiredist-web/assets/codeql-DsOJ9woJ.js
MediumNetwork
Affected versions and remediation
This report applies to cyberneurova-cli@0.20.1.
See all versions of cyberneurova-cli for other recorded verdicts.
- Review the evidence and your use of cyberneurova-cli@0.20.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.