Loading npm security reports…

devez-vibe@1.7.37: AI-agent control-surface risk | LPM Firewall

registry / devez-vibe / 1.7.37

devez-vibe@1.7.37

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Npm installation automatically plants and synchronizes a bundled skill in global Codex and Claude agent directories. The planted content changes future agent behavior and includes instructions for delegated Codex CLI execution.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing the package on supported Windows systems.

Impact

Future Codex and Claude sessions can load package-authored operational instructions without an explicit setup command.

Mechanism

Postinstall copies and prunes a bundled skill in user-wide AI-agent skill directories.

Policy narrative

During npm postinstall, the package writes its luna-loop skill to both Codex and Claude user configuration trees, then removes files not present in the package copy. This silently changes the instruction surface for future AI-agent sessions. The planted skill directs agents to delegate work and invoke Codex CLI commands, expanding the package's influence beyond its own CLI runtime.

Rationale

The postinstall hook silently mutates two foreign, user-wide AI-agent control surfaces and synchronizes their contents. This meets the install-control-surface block policy even though no direct exfiltration endpoint was found.

Evidence

package.jsoninstall-skills.mjsskills/luna-loop/SKILL.mdskills/luna-loop/$CODEX_HOME/skills/luna-loop$CLAUDE_CONFIG_DIR/skills/luna-loop

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node install-skills.mjs" }

High

Ai Review Evidence

The package automatically runs an installer after npm installation.

package.jsonView on unpkg · L40

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

18const targets = [ { name: "Codex", path: join(codexHome, "skills", "luna-loop") }, { name: "Claude", path: join(claudeHome, "skills", "luna-loop") }, ];

High

Ai Review Evidence

The installer copies and prunes a skill in both user-level Codex and Claude skill directories.

install-skills.mjsView on unpkg · L18

55let failed = false; for (const target of targets) { try { copyTree(sourceRoot, target.path); pruneTree(sourceRoot, target.path); console.log(`스킬 설치 완료 (${target.name}): ${target.path}`);

High

Ai Review Evidence

The installer copies and prunes a skill in both user-level Codex and Claude skill directories.

install-skills.mjsView on unpkg · L55

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24505344 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = devez-vibe@1.7.2 matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg