registry / devez-vibe / 1.9.52
devez-vibe@1.9.52
Stable terminal UI for Codex and Claude Agent SDK
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe inspected source confirms automatic installation-time setup of package-owned agent skills, with replacement or pruning possible within those skill directories. That warrants a warning for agent extension lifecycle risk, but the inspected behavior does not establish a broader control-surface hijack or other concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the npm package, which runs its postinstall hook.
Impact
Existing content in those two skill directories can be replaced or removed, and the bundled skills become available to the agents.
Mechanism
The installer copies each bundled skill into the user skill directories and prunes destination items that are not present in the bundle.
AI rationale
The inspected source confirms automatic installation-time setup of package-owned agent skills, with replacement or pruning possible within those skill directories. That warrants a warning for agent extension lifecycle risk, but the inspected behavior does not establish a broader control-surface hijack or other concrete attack.
Evidence
package.jsoninstall-skills.mjs~/.codex/skills/luna-loop~/.codex/skills/insane-search~/.claude/skills/luna-loop~/.claude/skills/insane-search
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall hook runs both the skill installer and the dependency preparation script.
- The installer targets the user's Codex and Claude skill directories and includes the luna-loop and insane-search skills.
- For each target, the installer copies the bundled skill, removes destination items absent from the bundle, and writes a bundled marker.
- The bridge's permission configuration can write to Claude user, project, or local settings files.
- Permission changes are exposed through a runtime permissions/update request; this is separate from the npm postinstall hook.
Evidence against
- The automatic agent-directory setup is limited to two package-owned skills; the inspected installer does not write broad agent settings or control files.
- The bridge's permission and plugin operations are runtime request handlers, not actions invoked by the postinstall script.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install-skills.mjs && node prepare-search-deps.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkginstall-skills.mjsView file
1import {
L2: copyFileSync,
L3: existsSync,
L4: mkdirSync,
L5: readdirSync,
L6: rmSync,
L7: writeFileSync,
L8: } from "node:fs";
...
L16: const userHome = homedir();
L17: const codexHome = process.env.CODEX_HOME?.trim() || join(userHome, ".codex");
L18: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(userHome, ".claude");
L19:
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
Findings
1 Critical4 High5 Medium4 Low
CriticalAi Agent Control Hijackinstall-skills.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirskills/insane-search/tests/live_benchmark/bench.py
HighKnown Malware Source Similaritybin/dvz.js
HighPrevious Version Dangerous Deltabridge/claude-agent-sdk-bridge.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarybin/dvz.exe
MediumShips Build Helperskills/insane-search/tests/live_benchmark/bench.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to devez-vibe@1.9.52.
See all versions of devez-vibe for other recorded verdicts.
- Review the evidence and your use of devez-vibe@1.9.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.