registry / AI-agent capability abuse / devil-ai / 0.14.1

devil-ai@0.14.1

Devil AI — AI-powered coding assistant. Install everything with: npm install -g devil-ai

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a dangerous explicit-user-command agent bridge that modifies a related agent configuration and executes remote installers. The postinstall hook is inert, so the inspected source does not establish malicious automatic install behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running devil-ai start, devil-ai config --model, or devil-ai setup.

Impact

A Telegram sender can submit prompts to the local coding agent; remote installer content can execute with the invoking user's privileges and elevated Linux setup uses sudo.

Mechanism

Telegram webhook forwarding, agent configuration mutation, and shell-based dependency installation.

AI rationale

Evidence

dist/cli.jsdist/telegram.js~/.config/opencode/opencode.json~/.config/devilcode/devilcode.json

Network endpoints4

api.telegram.org127.0.0.1deb.nodesource.comopencode.ai

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit start command modifies an existing OpenCode or DevilCode configuration file.
A Telegram webhook forwards received messages to a local OpenCode agent, creating a remote control path to that agent.
The explicit setup command executes remote installer scripts through a shell, including one with elevated Linux commands.

Evidence against

The install lifecycle only prints a message and does not execute the CLI.
No self-dependency, hidden payload, credential harvesting, or automatic network activity was found.
The risky behavior requires an explicit CLI command and a user-provided Telegram bot token.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 42.3 KB of source, external domains: 127.0.0.1, api.telegram.org, deb.nodesource.com, developers.cloudflare.com, github.com, opencode.ai

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = echo '\n ⚡ Devil AI installed! Run \x1b[1mdevil-ai setup\x1b[0m to install dependencies.\n'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = echo '\n ⚡ Devil AI installed! Run \x1b[1mdevil-ai setup\x1b[0m to install dependencies.\n'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/telegram.jsView file

1import { execSync, spawn } from "node:child_process"; L2: import { createServer } from "node:http";

High

Child Process

Package source references child process execution.

dist/telegram.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = devil-ai@0.14.0 matchedPath = dist/telegram.js matchedIdentity = npm:ZGV2aWwtYWk:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/telegram.jsView on unpkg

dist/shell-env.jsView file

24return new Promise((resolve, reject) => { L25: const shell = process.platform === "win32" ? "cmd.exe" : "bash"; L26: const shellArgs = process.platform === "win32" ? ["/c", "echo %PATH%"] : ["-l", "-c", "echo $PATH"];

High

Shell

Package source references shell execution.

dist/shell-env.jsView on unpkg · L24

•matchType = normalized_sha256 matchedPackage = devil-ai@0.14.0 matchedPath = dist/shell-env.js matchedIdentity = npm:ZGV2aWwtYWk:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/shell-env.jsView on unpkg

dist/opencode.jsView file

83try { L84: const { execSync } = await import("node:child_process"); L85: const whichCmd = process.platform === "win32" ? "where" : "which"; ... L93: stdio: "pipe", L94: env: { ...process.env, PATH: augmentedPath }, L95: }); L96: const url = `http://${hostname}:${port}`; L97: const server = { url, pid: proc.pid ?? null, managed: true };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/opencode.jsView on unpkg · L83

•matchType = normalized_sha256 matchedPackage = devil-ai@0.14.0 matchedPath = dist/opencode.js matchedIdentity = npm:ZGV2aWwtYWk:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/opencode.jsView on unpkg

dist/cli.jsView file

1import { execSync, spawn } from "node:child_process"; L2: import fs from "node:fs"; ... L23: function getDevilCodeConfigPath() { L24: const platform = process.platform; L25: // Try DevilCode config path first, then fallback to OpenCode L26: if (platform === "win32") { L27: const devilcodePath = path.join(os.homedir(), "AppData", "Roaming", "devilcode", "devilcode.json"); L28: const opencodePath = path.join(os.homedir(), "AppData", "Roaming", "opencode", "opencode.json"); ... L48: try { L49: config = JSON.parse(fs.readFileSync(configPath, "utf-8")); L50: } ... L268: const proc = spawn(cmd, args, { stdio: "pipe", shell: true });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = devil-ai@0.14.0 matchedPath = dist/cli.js matchedIdentity = npm:ZGV2aWwtYWk:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bffbbceeb8f995c3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = devil-ai@0.14.0 matchedPath = dist/cli.js matchedIdentity = npm:ZGV2aWwtYWk:0.14.0 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = echo '\n ⚡ Devil AI installed! Run \x1b[1mdevil-ai setup\x1b[0m to install dependencies.\n'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = echo '\n ⚡ Devil AI installed! Run \x1b[1mdevil-ai setup\x1b[0m to install dependencies.\n'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/telegram.jsView file

1import { execSync, spawn } from "node:child_process"; L2: import { createServer } from "node:http";

High

Child Process

Package source references child process execution.

dist/telegram.jsView on unpkg · L1

Findings

10 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/telegram.js

HighShelldist/shell-env.js

HighSame File Env Network Executiondist/opencode.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/opencode.js

HighKnown Malware Source Similaritydist/shell-env.js

HighKnown Malware Source Similaritydist/telegram.js

HighKnown Malware Source Fingerprint Signaturedist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

Affected versions and remediation

This report applies to devil-ai@0.14.1.

See all versions of devil-ai for other recorded verdicts.

Review the evidence and your use of devil-ai@0.14.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 02:45:32.498Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.