registry / cyberneurova-cli / 0.20.7
cyberneurova-cli@0.20.7
The CyberNeurova terminal AI coding agent
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe reviewed API-key flow configures CyberNeurova’s branded service and saves the key as provider configuration. The flagged metadata and process APIs occur in bundled cloud-auth and CLI functionality; no automatic credential collection or unrelated exfiltration was established.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user configures the CyberNeurova API-key provider or starts the CLI.
Impact
No unauthorized credential transfer, harmful install-time action, or unrelated code execution was established.
Mechanism
The provider uses api.cyberneurova.ai, and setup saves its key with the selected provider configuration. Telemetry has a disable setting.
AI rationale
The reviewed API-key flow configures CyberNeurova’s branded service and saves the key as provider configuration. The flagged metadata and process APIs occur in bundled cloud-auth and CLI functionality; no automatic credential collection or unrelated exfiltration was established.
Network endpoints2
api.cyberneurova.ai/v1cyberneurova.ai
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as CyberNeurova’s terminal AI coding agent and exposes its CLI through dist/main.mjs.
- The configured CyberNeurova API-key provider uses the branded api.cyberneurova.ai endpoint.
- Provider setup stores the entered key in configuration alongside the selected provider and model.
- Telemetry can be disabled with CYBERNEUROVA_DISABLE_TELEMETRY.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
11 flaggeddist/main.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = cyberneurova-cli@0.20.1
matchedIdentity = npm:Y3liZXJuZXVyb3ZhLWNsaQ:0.20.1
similarity = 0.967
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/main.mjsView on unpkg5const __dirname = __cjsShimDirname(__filename);
L6: import{createRequire as e}from"node:module";import*as t from"pathe";import n,{basename as r,dirname as i,isAbsolute as a,join as o,normalize as s,parse as c,relative as l,resolve a...
L7: `):[]}};qi=new WeakMap,Ji=new WeakMap,Yi.NEWLINE_CHARS=new Set([`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/main.mjsView on unpkg · L5•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/main.mjs:
import{createRequire as e}from"node:module";import*as t from"pathe";import n,{basename as r,dirname as i,isAbsolute as a,join as o,normalize as s,parse as c,relative as l,resolve a...
`)}\n${a}\n${t}`)}return a})(va);var xa=class extends ha{create(e,t){let{betas:n,...r}=e;return this._client.post(`/v1/environments?beta=true`,{body:r,...t,headers:_a([{"anthropic-...
Wrap your summary in <summary></summary> tags.`,a=W(this,bo,`f`).params.messages;if(a[a.length-1].role===`assistant`){let e=a[a.length-1];if(Array.isArray(e.content)){let t=e.conte...
`);this.baseURL=a.baseURL,this._baseURLIsExplicit=i.__baseURLIsExplicit??!!e
Findings
1 Critical7 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/main.mjs
HighSame File Env Network Executiondist/main.mjs
HighCredential Redirect Persistencedist/main.mjs
HighCommand Output Exfiltrationdist/main.mjs
HighCloud Metadata Accessdist/main.mjs
HighTrigger Reachable Command Output Exfiltrationdist/main.mjs
HighSemantic Analysis Limiteddist-web/assets/CodeBlockNode-B8Y2oNuu.js
HighKnown Malware Source Similaritydist-web/assets/chunk-AQP2D5EJ-Dkgu36A1.js
MediumDynamic Requiredist/main.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/main.mjs
Affected versions and remediation
This report applies to cyberneurova-cli@0.20.7.
See all versions of cyberneurova-cli for other recorded verdicts.
- Review the evidence and your use of cyberneurova-cli@0.20.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.