registry / devez-vibe / 1.7.38

devez-vibe@1.7.38

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Npm installation automatically installs a package-supplied skill into both Codex and Claude user-level skill directories. It also prunes files in those installed skill directories.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing the package runs its postinstall lifecycle hook.

Impact

It mutates broad AI-agent control surfaces without an explicit setup command, affecting later agent sessions.

Mechanism

Automatic cross-agent user-skill deployment and pruning.

Policy narrative

During npm postinstall, the package copies its bundled luna-loop skill into the user's Codex and Claude skill locations. The operation is automatic and prunes destination content, so later agent sessions can load package-controlled instructions without the user deliberately enabling this integration.

Rationale

This is an unconsented postinstall mutation of foreign, user-level AI-agent control surfaces. The lack of network activity does not remove the persistence and control-surface risk.

Evidence

package.jsoninstall-skills.mjsskills/luna-loop~/.codex/skills/luna-loop~/.claude/skills/luna-loop

Decision evidence

public snapshot

AI identified this as a at 96.0% confidence with false-positive risk.

devez-vibe@1.7.38

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code