registry / cyberneurova-cli / 0.20.3
cyberneurova-cli@0.20.3
The CyberNeurova terminal AI coding agent
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe credential flow prompts for a key, verifies it with the selected provider, and stores the resulting configuration. The shell-based update path belongs to the CLI’s updater and uses the package’s official host; no malicious behavior was established.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
CLI use; login and provider setup require user action, while update checks occur during CLI operation.
Impact
No unauthorized credential disclosure or unrelated account action was found.
Mechanism
The CLI verifies a user-entered API key against the selected provider and stores its configuration. The native updater uses the package’s official installer when auto-install is enabled.
AI rationale
The credential flow prompts for a key, verifies it with the selected provider, and stores the resulting configuration. The shell-based update path belongs to the CLI’s updater and uses the package’s official host; no malicious behavior was established.
Evidence
~/.cyberneurova/config.toml
Network endpoints3
api.cyberneurova.aiplatform.cyberneurova.comcyberneurova.ai
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the bundled CLI as its executable and has no install, preinstall, or postinstall hook.
- The API-key setup asks the user to enter a key, verifies it for the selected provider, then saves provider configuration; CyberNeurova’s configured API endpoint is api.cyberneurova.ai.
- The built-in updater uses the package’s official cyberneurova.ai installer and only starts background installation when auto-install is enabled and the install source supports it.
Evidence against
- The CLI includes shell execution and a download-and-run installer path for its native-platform updater.
- The CLI stores provider configuration, including API keys, in ~/.cyberneurova/config.toml.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
11 flaggeddist-web/assets/index-CxRV4At0.jsView file
152?|[
L153: \v\f
\u2028\u2029])`),t));else if(l==="posix")if(!i&&(p==="graph"||p==="print")){if(r==="strict")throw new Error(`POSIX class "${p}" requires min target ES2024 or non-strict accura...
High
Child Process
Package source references child process execution.
dist-web/assets/index-CxRV4At0.jsView on unpkg · L152dist-web/assets/codeql-DsOJ9woJ.jsView file
1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1dist/main.mjsView file
Findings
1 Critical7 High7 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/main.mjs
HighChild Processdist-web/assets/index-CxRV4At0.js
HighSame File Env Network Executiondist/main.mjs
HighCredential Redirect Persistencedist/main.mjs
HighCommand Output Exfiltrationdist/main.mjs
HighTrigger Reachable Command Output Exfiltrationdist/main.mjs
HighSemantic Analysis Limiteddist-web/assets/CodeBlockNode-B8Y2oNuu.js
HighKnown Malware Source Similaritydist-web/assets/cytoscape.esm-nFXppDBa.js
MediumDynamic Requiredist-web/assets/codeql-DsOJ9woJ.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
Affected versions and remediation
This report applies to cyberneurova-cli@0.20.3.
See all versions of cyberneurova-cli for other recorded verdicts.
- Review the evidence and your use of cyberneurova-cli@0.20.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.