Loading npm security reports…

devez-vibe@1.7.57: AI-agent control-surface risk | LPM Firewall

registry / devez-vibe / 1.7.57

devez-vibe@1.7.57

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes both Codex and Claude user agent skill surfaces. It also installs user-scoped Python dependencies and deploys a skill that directs agents to use WAF-evasion tooling.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation.

Impact

A package install can persist package-controlled instructions in broad AI-agent configuration locations and cause later agent sessions to run network access-evasion workflows.

Mechanism

Automatic cross-agent skill deployment, deletion, and dependency installation.

Policy narrative

The package runs automatically after npm installation. That hook copies and prunes package-controlled skills in both Codex and Claude user directories without a user command, then installs Python dependencies into the user environment. One deployed skill directs future agents to execute a fetch engine designed to bypass blocked sites using TLS impersonation, URL transforms, and browser fallback. This creates a broad, persistent agent control surface from an install-time hook.

Rationale

This is concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The installed capability also drives automated access-evasion behavior, so it meets the install-hook abuse blocking policy.

Evidence

package.jsoninstall-skills.mjsprepare-search-deps.mjsskills/insane-search/SKILL.md~/.codex/skills/luna-loop~/.codex/skills/insane-search

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24654848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

skills/insane-search/tests/live_benchmark/bench.pyView file

•path = skills/insane-search/tests/live_benchmark/bench.py kind = payload_in_excluded_dir sizeBytes = 4268 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

•path = skills/insane-search/tests/live_benchmark/bench.py kind = build_helper sizeBytes = 4268 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.7.55 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 3aae36a4767aa4d7 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devez-vibe@1.7.55 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.55 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg