Loading npm security reports…

devez-vibe@1.7.61: Malicious npm security report (Block) | LPM Firewall

registry / devez-vibe / 1.7.61

devez-vibe@1.7.61

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically modifies both Codex and Claude user skill directories. It also installs Python dependencies into the user's environment.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

Package-controlled instructions and code are placed into broad AI-agent control surfaces without an explicit user command; existing skill files may be deleted.

Mechanism

automatic cross-agent skill deployment and user-level pip installation

Attack narrative

On installation, npm runs the package's postinstall hook. That hook copies package-supplied skills into both Codex and Claude configuration trees and prunes files from those targets. It then runs pip with --user to install additional dependencies. This is an unconsented install-time mutation of broad AI-agent control surfaces and the user environment.

Rationale

The lifecycle hook makes broad AI-agent configuration changes and user-level dependency installation automatically. This meets the install-hook abuse blocking policy even though no direct credential exfiltration was found.

Evidence

package.jsoninstall-skills.mjsprepare-search-deps.mjs~/.codex/skills/luna-loop~/.codex/skills/insane-search~/.claude/skills/luna-loop~/.claude/skills/insane-search

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, ... L14: const userHome = homedir(); L15: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L16: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L17: ... L23: function copyTree(source, destination) { L24: mkdirSync(destination, { recursive: true }); L25: for (const entry of readdirSync(source, { withFileTypes: true })) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install-skills.mjsView on unpkg · L1

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24631808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

skills/insane-search/tests/live_benchmark/bench.pyView file

•path = skills/insane-search/tests/live_benchmark/bench.py kind = payload_in_excluded_dir sizeBytes = 4268 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

•path = skills/insane-search/tests/live_benchmark/bench.py kind = build_helper sizeBytes = 4268 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.7.60 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.60 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 843616fe96ffd50a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devez-vibe@1.7.60 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.60 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 23-49json

23 "files": [

24 "bin/dvz.exe",

25 "bridge/claude-agent-sdk-bridge.mjs",

26 "install-skills.mjs",

27 "prepare-search-deps.mjs",

28 "skills/luna-loop/",

29 "skills/insane-search/",

30 "README.md",

31 "LICENSE"

32 ],

33 "os": [

34 "win32"

35 ],

36 "cpu": [

37 "x64"

38 ],

39 "engines": {

40 "node": ">=18"

41 },

42 "scripts": {

43 "postinstall": "node install-skills.mjs && node prepare-search-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 },

45 "dependencies": {

46 "@anthropic-ai/claude-agent-sdk": "0.3.260"

47 }

48}

49

install-skills.mjsView file

Lines 1-21javascript

1import {

2 copyFileSync,

3 existsSync,

4 mkdirSync,

5 readdirSync,

6 rmSync,

7} from "node:fs";

8import { homedir } from "node:os";

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 24631808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

skills/insane-search/tests/live_benchmark/bench.pyView file

•path = skills/insane-search/tests/live_benchmark/bench.py kind = payload_in_excluded_dir sizeBytes = 4268 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

•path = skills/insane-search/tests/live_benchmark/bench.py kind = build_helper sizeBytes = 4268 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.7.60 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.60 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 843616fe96ffd50a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devez-vibe@1.7.60 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.7.60 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg