Loading npm security reports…

devez-vibe@1.7.34: AI-agent control-surface risk | LPM Firewall

registry / devez-vibe / 1.7.34

devez-vibe@1.7.34

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall copies a package-controlled agent skill into the user-wide Codex and Claude skill locations without a user command. The installed instructions can cause later agent-driven subprocess and delegation activity.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing the npm package runs the postinstall hook.

Impact

It persistently changes the instructions available to two separate AI-agent control surfaces.

Mechanism

Automatic mutation of shared AI-agent skill directories.

Policy narrative

Installing the package invokes install-skills.mjs. That script copies the bundled luna-loop skill into both the user's Codex and Claude shared skill directories, replacing and pruning their contents. The skill is then available to influence future agent sessions and includes instructions to create agents and launch Codex as a subprocess. This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Rationale

The postinstall hook persistently writes package-authored instructions into shared Codex and Claude directories. That concrete cross-agent control-surface mutation warrants blocking even though the inspected text sources show no direct exfiltration endpoint.

Evidence

package.jsoninstall-skills.mjsskills/luna-loop/SKILL.md.codex/skills/luna-loop.claude/skills/luna-loopskills/luna-loop/

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node install-skills.mjs" },

High

Ai Review Evidence

The package automatically runs an installer after npm installation.

package.jsonView on unpkg · L40

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

14const userHome = homedir(); const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); const targets = [ { name: "Codex", path: join(codexHome, "skills", "luna-loop") }, { name: "Claude", path: join(claudeHome, "skills", "luna-loop") }, ];

High

Ai Review Evidence

The installer writes a bundled skill into both user-wide Codex and Claude skill directories.

install-skills.mjsView on unpkg · L14

55let failed = false; for (const target of targets) { try { copyTree(sourceRoot, target.path); pruneTree(sourceRoot, target.path); console.log(`스킬 설치 완료 (${target.name}): ${target.path}`);

High

Ai Review Evidence

The installer writes a bundled skill into both user-wide Codex and Claude skill directories.

install-skills.mjsView on unpkg · L55

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24441856 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = devez-vibe@1.7.2 matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg