devez-vibe@1.7.39

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic cross-agent skill installation is a real lifecycle risk, but the source shows a bounded named skill deployment rather than exfiltration, remote execution, or broad configuration takeover.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation.

Impact

Changes the behavior available to both local agent clients without an explicit setup command.

Mechanism

Automatic user-level AI-agent skill deployment and pruning.

AI rationale

Evidence

package.jsoninstall-skills.mjsskills/luna-loop~/.codex/skills/luna-loop~/.claude/skills/luna-loop

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The npm postinstall hook automatically runs an installer.
The installer copies a packaged skill into both Codex and Claude user-level skill directories.
The install routine also recursively removes destination entries absent from the packaged skill.

Evidence against

The copied skill is a package-owned, specifically named extension rather than a broad configuration rewrite.
The bridge removes Anthropic API key variables before spawning Claude commands.
No package source shows network exfiltration, remote payload download, or runtime self-dependency.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 183 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 20-47json

20 "bin": {

21 "dvz": "bin/dvz.exe"

22 },

23 "files": [

24 "bin/dvz.exe",

25 "bridge/claude-agent-sdk-bridge.mjs",

26 "install-skills.mjs",

27 "skills/luna-loop/",

28 "README.md",

29 "LICENSE"

30 ],

31 "os": [

32 "win32"

33 ],

34 "cpu": [

35 "x64"

36 ],

37 "engines": {

38 "node": ">=18"

39 },

40 "scripts": {

41 "postinstall": "node install-skills.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

42 },

43 "dependencies": {

44 "@anthropic-ai/claude-agent-sdk": "0.3.260"

45 }

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs an installer.

package.jsonView on unpkg · L40

46}

install-skills.mjsView file

Lines 1-68javascript

1import {

2 copyFileSync,

3 existsSync,

4 mkdirSync,

5 readdirSync,

6 rmSync,

7} from "node:fs";

8import { homedir } from "node:os";

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24506880 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = devez-vibe@1.7.2 matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node install-skills.mjs" }, "dependencies": { "@anthropic-ai/claude-agent-sdk": "0.3.260" }

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs an installer.

package.jsonView on unpkg · L40

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Findings

1 Critical2 High6 Medium3 Low

CriticalAi Agent Control Hijackinstall-skills.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltabridge/claude-agent-sdk-bridge.mjs

MediumEnvironment Vars

MediumShips Native Binarybin/dvz.exe

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidenceinstall-skills.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to devez-vibe@1.7.39.

See all versions of devez-vibe for other recorded verdicts.

Review the evidence and your use of devez-vibe@1.7.39 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 19:54:20.207Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.