Loading npm security reports…

devez-vibe@1.6.54: AI-agent control-surface risk | LPM Firewall

registry / devez-vibe / 1.6.54

devez-vibe@1.6.54

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall copies the packaged luna-loop skill into the user's Codex and Claude skill directories and prunes extra files there. Those paths are foreign agent control surfaces, not a package-owned config folder.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of devez-vibe, which runs the postinstall script.

Impact

Codex CLI and Claude Code can load package-supplied skill instructions from the user's agent skill folders after a normal install.

Mechanism

unconsented install-time copy into Codex and Claude user skill directories

Policy narrative

Installing devez-vibe runs postinstall, which copies skills/luna-loop into ~/.codex/skills/luna-loop and ~/.claude/skills/luna-loop (or CODEX_HOME and CLAUDE_CONFIG_DIR) and deletes extra files in those folders. Codex and Claude later read those skill trees, so the packaged instructions become part of the user's agent control surface without a separate setup command.

AI rationale

The postinstall hook writes a packaged skill into Codex and Claude user skill directories without a user command, which is unconsented mutation of foreign AI-agent control surfaces. README disclosure does not count as consent, so this release should be blocked.

Evidence

package.jsoninstall-skills.mjsskills/luna-loop/SKILL.mdskills/luna-loop/~/.codex/skills/luna-loop~/.claude/skills/luna-loop

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node install-skills.mjs" },

High

Suspicious Lifecycle Evidence

package.json postinstall runs node install-skills.mjs on every npm install with no opt-in flag.

package.jsonView on unpkg · L40

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

14const userHome = homedir(); const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); const targets = [ { name: "Codex", path: join(codexHome, "skills", "luna-loop") }, { name: "Claude", path: join(claudeHome, "skills", "luna-loop") }, ];

High

Ai Review Evidence

install-skills.mjs copies skills/luna-loop into the user Codex and Claude skill directories under homedir, CODEX_HOME, or CLAUDE_CONFIG_DIR.

install-skills.mjsView on unpkg · L14

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24493568 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.6.57 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.6.57 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1466de81dd2a8cd0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devez-vibe@1.6.57 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.6.57 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg