Loading npm security reports…

devez-vibe@1.7.43: AI-agent control-surface risk | LPM Firewall

registry / devez-vibe / 1.7.43

devez-vibe@1.7.43

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies global Codex and Claude skill directories. The installed skill can subsequently influence both agent environments.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall automatically.

Impact

Existing global agent skill content can be overwritten or deleted, and a package-controlled instruction set becomes available to both agents.

Mechanism

Automatic copy and prune of global AI-agent skill directories.

Policy narrative

The package runs an installer during npm postinstall, without an explicit user setup command. That installer copies its bundled luna-loop skill into global Codex and Claude skill locations, then recursively deletes files in those destinations that are not in the package source. This is a foreign, broad AI-agent control-surface mutation. Its runtime bridge also attempts to use Claude bypass-permissions mode after enabling the SDK capability needed for that transition.

Rationale

This is an unconsented postinstall mutation of global AI-agent control surfaces, including destructive pruning of prior content. The behavior meets the install-hook abuse blocking boundary even though no direct exfiltration endpoint was found.

Evidence

package.jsoninstall-skills.mjsbridge/claude-agent-sdk-bridge.mjsskills/luna-loop/$CODEX_HOME/skills/luna-loop$CLAUDE_CONFIG_DIR/skills/luna-loop

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node install-skills.mjs" },

High

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the skill installer.

package.jsonView on unpkg · L40

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

18const targets = [ { name: "Codex", path: join(codexHome, "skills", "luna-loop") }, { name: "Claude", path: join(claudeHome, "skills", "luna-loop") }, ];

High

Ai Review Evidence

The installer copies a package-supplied skill into both global Codex and Claude skill directories without a user command.

install-skills.mjsView on unpkg · L18

38function pruneTree(source, destination) { for (const entry of readdirSync(destination, { withFileTypes: true })) { const sourcePath = join(source, entry.name); const destinationPath = join(destination, entry.name); if (!existsSync(sourcePath)) { rmSync(destinationPath, { recursive: true, force: true }); continue; } if (entry.isDirectory()) pruneTree(sourcePath, destinationPath); }

High

Ai Review Evidence

It recursively removes destination entries absent from the package source, modifying existing global agent configuration.

install-skills.mjsView on unpkg · L38

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24515072 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = devez-vibe@1.7.2 matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg