registry / cyberneurova-cli / 0.20.2
cyberneurova-cli@0.20.2
The CyberNeurova terminal AI coding agent
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package is a CLI, and the inspected credential flow is explicitly for configuring CyberNeurova with its own API key. Metadata and command-execution references are consistent with bundled SDK and agent functionality; no default collection or unrelated exfiltration was established.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user selects the CyberNeurova API-key setup flow.
Impact
No unauthorized credential collection, command-output exfiltration, or account action was identified.
Mechanism
The CLI verifies the entered key against CyberNeurova’s models endpoint and saves it with the selected provider configuration.
AI rationale
The package is a CLI, and the inspected credential flow is explicitly for configuring CyberNeurova with its own API key. Metadata and command-execution references are consistent with bundled SDK and agent functionality; no default collection or unrelated exfiltration was established.
Evidence
~/.cyberneurova/config.toml
Network endpoints1
api.cyberneurova.ai
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/main.mjs as the CLI executable.
- The API-key setup identifies CyberNeurova and its API and console hosts.
- The entered key is sent as a bearer token to that provider’s /models endpoint for verification.
- After setup, the selected provider and key are saved to the CLI configuration.
- Telemetry can be disabled through configuration; the settings UI exposes a telemetry switch.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
12 flaggeddist-web/assets/index-CxRV4At0.jsView file
152?|[
L153: \v\f
\u2028\u2029])`),t));else if(l==="posix")if(!i&&(p==="graph"||p==="print")){if(r==="strict")throw new Error(`POSIX class "${p}" requires min target ES2024 or non-strict accura...
High
Child Process
Package source references child process execution.
dist-web/assets/index-CxRV4At0.jsView on unpkg · L152dist/main.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = cyberneurova-cli@0.20.1
matchedIdentity = npm:Y3liZXJuZXVyb3ZhLWNsaQ:0.20.1
similarity = 0.967
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/main.mjsView on unpkg5const __dirname = __cjsShimDirname(__filename);
L6: import{createRequire as e}from"node:module";import*as t from"pathe";import n,{basename as r,dirname as i,isAbsolute as a,join as o,normalize as s,parse as c,relative as l,resolve a...
L7: `):[]}};qi=new WeakMap,Ji=new WeakMap,Yi.NEWLINE_CHARS=new Set([`
Findings
1 Critical8 High6 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/main.mjs
HighChild Processdist-web/assets/index-CxRV4At0.js
HighSame File Env Network Executiondist/main.mjs
HighCredential Redirect Persistencedist/main.mjs
HighCommand Output Exfiltrationdist/main.mjs
HighCloud Metadata Accessdist/main.mjs
HighTrigger Reachable Command Output Exfiltrationdist/main.mjs
HighSemantic Analysis Limiteddist-web/assets/CodeBlockNode-B8Y2oNuu.js
HighKnown Malware Source Similaritydist-web/assets/chunk-AQP2D5EJ-Dkgu36A1.js
MediumDynamic Requiredist/main.mjs
MediumNetwork
Medium
Affected versions and remediation
This report applies to cyberneurova-cli@0.20.2.
See all versions of cyberneurova-cli for other recorded verdicts.
- Review the evidence and your use of cyberneurova-cli@0.20.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.