Loading npm security reports…

devez-vibe@1.7.10: AI-agent control-surface risk | LPM Firewall

registry / devez-vibe / 1.7.10

devez-vibe@1.7.10

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On installation, the package silently installs and synchronizes a bundled agent skill in the user-level configuration directories of both Codex and Claude. The installed skill can direct later agent activity, including launching Codex from Claude.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall on a supported Windows installation.

Impact

It establishes unconsented persistence in broad AI-agent control surfaces and can influence later agent execution.

Mechanism

Automatic cross-agent skill installation and recursive synchronization.

Policy narrative

The npm postinstall hook runs without a separate setup command. It copies the bundled luna-loop skill into both Codex and Claude user configuration directories, then recursively deletes destination files that are not in the package copy. This changes two unrelated agent control surfaces and leaves a persistent instruction payload. The payload directs agent workflows and includes launching Codex through a child process from Claude.

Rationale

This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces, with persistent instruction content and destructive synchronization. It meets the install-hook abuse blocking boundary even without confirmed network exfiltration.

Evidence

package.jsoninstall-skills.mjsskills/luna-loop/SKILL.md~/.codex/skills/luna-loop~/.claude/skills/luna-loop

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node install-skills.mjs" },

High

Ai Review Evidence

The package runs an installer automatically after npm installation.

package.jsonView on unpkg · L40

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

13const sourceRoot = join(packageRoot, "skills", "luna-loop"); const userHome = homedir(); const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); const targets = [ { name: "Codex", path: join(codexHome, "skills", "luna-loop") }, { name: "Claude", path: join(claudeHome, "skills", "luna-loop") }, ];

High

Ai Review Evidence

The installer writes a bundled skill into both user-level Codex and Claude skill directories.

install-skills.mjsView on unpkg · L13

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24389120 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.7.9 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7ad776c0d0eeac91 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devez-vibe@1.7.9 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.9 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 20-47json

20 "bin": {

21 "dvz": "bin/dvz.exe"

22 },

23 "files": [

24 "bin/dvz.exe",

25 "bridge/claude-agent-sdk-bridge.mjs",

26 "install-skills.mjs",

27 "skills/luna-loop/",

28 "README.md",

29 "LICENSE"

30 ],

31 "os": [

32 "win32"

33 ],

34 "cpu": [

35 "x64"

36 ],

37 "engines": {

38 "node": ">=18"

39 },

40 "scripts": {

41 "postinstall": "node install-skills.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

42 },

High

Ai Review Evidence

The package runs an installer automatically after npm installation.

package.jsonView on unpkg · L40

43 "dependencies": {

44 "@anthropic-ai/claude-agent-sdk": "0.3.251"

45 }

46}

47

install-skills.mjsView file

Lines 1-33javascript

1import {

2 copyFileSync,

3 existsSync,

4 mkdirSync,

5 readdirSync,

6 rmSync,

7} from "node:fs";

8import { homedir } from "node:os";

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24389120 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.7.9 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7ad776c0d0eeac91 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devez-vibe@1.7.9 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.9 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg