registry / devez-vibe / 1.7.40

devez-vibe@1.7.40

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the npm package changes two user-level AI-agent skill directories. It copies a package-controlled skill and prunes files from those destinations.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

The package can alter the instructions available to Codex and Claude for the user account without an explicit setup action.

Mechanism

Automatic cross-agent skill installation and pruning.

Policy narrative

A normal npm install invokes install-skills.mjs. That script resolves the user's Codex and Claude configuration homes, copies its bundled luna-loop skill into both global skill directories, and deletes destination entries missing from the package source. This is an unconsented postinstall mutation of foreign AI-agent control surfaces.

Rationale

The automatic lifecycle hook modifies both Codex and Claude user-level skill surfaces and prunes their contents. That concrete behavior meets the install-control-surface blocking policy even though no exfiltration was found in the inspected source.

Evidence

package.jsoninstall-skills.mjsCODEX_HOME/skills/luna-loopCLAUDE_CONFIG_DIR/skills/luna-loop

Decision evidence

public snapshot

with false-positive risk.

devez-vibe@1.7.40

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code