devez-vibe@1.9.30

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Automatic installation into global AI-agent skill roots is a concrete extension lifecycle risk. The inspected source does not establish the additional attack behavior required for blocking.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm post-install runs automatically when the package is installed.

Impact

This creates an automatic agent-extension lifecycle risk and changes user-level package dependencies; no confirmed active attack was established.

Mechanism

The lifecycle hook copies and prunes package-managed skill folders in agent skill roots and performs user-scoped Python dependency installation.

AI rationale

Automatic installation into global AI-agent skill roots is a concrete extension lifecycle risk. The inspected source does not establish the additional attack behavior required for blocking.

Evidence

package.jsoninstall-skills.mjsprepare-search-deps.mjsbridge/claude-agent-sdk-bridge.mjs

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares a post-install hook that runs the skill installer and Python dependency setup.
The skill installer targets the global Codex and Claude skill directories under the user configuration locations.
That install-time script copies bundled skill trees into those agent directories and removes entries absent from the bundled source.
The post-install setup invokes user-scoped pip installation.
The bridge can write Claude permission settings when its permission-update operation is invoked.

Evidence against

The inspected manifest has no self-dependency.
No credential collection or exfiltration sink was identified in the inspected locations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 257 KB of source, external domains: claude.ai

Source & flagged code

9 flagged

package.jsonView file

Lines 25-51json

25 "bin/dvz.js",

26 "bin/dvz.exe",

27 "bridge/claude-agent-sdk-bridge.mjs",

28 "install-skills.mjs",

29 "prepare-search-deps.mjs",

30 "skills/luna-loop/",

31 "skills/insane-search/",

32 "README.md",

33 "LICENSE"

34 ],

35 "os": [

36 "win32"

37 ],

38 "cpu": [

39 "x64"

40 ],

41 "engines": {

42 "node": ">=18"

43 },

44 "scripts": {

45 "postinstall": "node install-skills.mjs && node prepare-search-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 },

47 "dependencies": {

48 "@anthropic-ai/claude-agent-sdk": "0.3.280"

49 }

50}

install-skills.mjsView file

Lines 1-21javascript

1import {

2 copyFileSync,

3 existsSync,

4 mkdirSync,

5 readdirSync,

6 rmSync,

7 writeFileSync,

8} from "node:fs";

9import { homedir } from

bin/dvz.exeView file

•path = bin/dvz.exe kind = native_binary sizeBytes = 25572352 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dvz.exeView on unpkg

skills/insane-search/tests/live_benchmark/bench.pyView file

•path = skills/insane-search/tests/live_benchmark/bench.py kind = payload_in_excluded_dir sizeBytes = 4268 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

•path = skills/insane-search/tests/live_benchmark/bench.py kind = build_helper sizeBytes = 4268 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/insane-search/tests/live_benchmark/bench.pyView on unpkg

bridge/claude-agent-sdk-bridge.mjsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.9.32 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.9.32 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d7bcb171f034bbe8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devez-vibe@1.9.32 matchedPath = bridge/claude-agent-sdk-bridge.mjs matchedIdentity = npm:ZGV2ZXotdmliZQ:1.9.32 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bridge/claude-agent-sdk-bridge.mjsView on unpkg

bin/dvz.jsView file

•matchType = normalized_sha256 matchedPackage = devez-vibe@1.9.32 matchedPath = bin/dvz.js matchedIdentity = npm:ZGV2ZXotdmliZQ:1.9.32 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/dvz.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install-skills.mjsView file

1import { L2: copyFileSync, L3: existsSync, L4: mkdirSync, L5: readdirSync, L6: rmSync, L7: writeFileSync, L8: } from "node:fs"; ... L16: const userHome = homedir(); L17: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex"); L18: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude"); L19:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

Findings

1 Critical5 High5 Medium4 Low

CriticalAi Agent Control Hijackinstall-skills.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirskills/insane-search/tests/live_benchmark/bench.py

HighKnown Malware Source Similaritybridge/claude-agent-sdk-bridge.mjs

HighKnown Malware Source Similaritybin/dvz.js

HighKnown Malware Source Fingerprint Signaturebridge/claude-agent-sdk-bridge.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Native Binarybin/dvz.exe

MediumShips Build Helperskills/insane-search/tests/live_benchmark/bench.py

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to devez-vibe@1.9.30.

See all versions of devez-vibe for other recorded verdicts.

Review the evidence and your use of devez-vibe@1.9.30 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 02:45:57.013Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.