Loading npm security reports…

devez-vibe@1.7.35: AI-agent control-surface risk | LPM Firewall

registry / devez-vibe / 1.7.35

devez-vibe@1.7.35

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies two unrelated user-level AI-agent skill directories. It places a persistent agent instruction set and synchronizes it by removing files no longer present in the package.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation, which invokes the postinstall lifecycle hook.

Impact

Unconsented modification of broad Codex and Claude control surfaces can influence later agent behavior.

Mechanism

Postinstall installation and pruning of a package-supplied AI-agent skill.

Policy narrative

During npm installation, package.json runs install-skills.mjs. That script copies the bundled luna-loop skill into the user's Codex and Claude skill directories and prunes files from those destinations. The installed skill contains operational instructions for future AI-agent sessions, including a Codex CLI invocation. This is an automatic, unconsented mutation of broad third-party AI-agent control surfaces.

Rationale

The automatic postinstall hook persistently injects and synchronizes package-controlled instructions in both Codex and Claude user directories. This satisfies the install-control-surface block policy even without confirmed network exfiltration.

Evidence

package.jsoninstall-skills.mjsskills/luna-loop/SKILL.mdskills/luna-loop/$CODEX_HOME/skills/luna-loop$CLAUDE_CONFIG_DIR/skills/luna-loop

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node install-skills.mjs" }

High

Suspicious Lifecycle Evidence

The package runs install-skills.mjs automatically through postinstall.

package.jsonView on unpkg · L40

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

12const packageRoot = dirname(fileURLToPath(import.meta.url)); const sourceRoot = join(packageRoot, "skills", "luna-loop"); const userHome = homedir(); const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); const targets = [ { name: "Codex", path: join(codexHome, "skills", "luna-loop") }, { name: "Claude", path: join(claudeHome, "skills", "luna-loop") }, ];

High

Ai Review Evidence

The installer writes a package-supplied skill into both Codex and Claude user skill directories.

install-skills.mjsView on unpkg · L12

55let failed = false; for (const target of targets) { try { copyTree(sourceRoot, target.path); pruneTree(sourceRoot, target.path); console.log(`스킬 설치 완료 (${target.name}): ${target.path}`);

High

Ai Review Evidence

The installer recursively copies the skill and deletes destination entries absent from the package source.

install-skills.mjsView on unpkg · L55

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24502272 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = devez-vibe@1.7.2 matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg