registry / Data exfiltration / fablever

fablever

A zero-dependency working-style + discipline layer for Claude Code AND Codex CLI: scope control, evidence-grounded completion, and deterministic delivery checks. Claude Code via output style + hooks + MCP; Codex CLI via AGENTS.md + hooks + MCP + on-demand

This report shows the evidence for fablever@1.3.0, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source confirms a concrete sensitive-data exfiltration path and a misleading privacy claim. Absence of lifecycle execution reduces reach but does not negate the behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running `node eval/real-log-replay/run-replay.mjs` without an action argument, then supplying `GEMINI_API_KEY`.

Impact

Disclosure of real prompts and generated replies to a third-party API.

Mechanism

Local transcript harvesting followed by outbound Gemini judging.

Attack narrative

The evaluator's default branch extracts real Claude Code transcript prompts from a hard-coded local projects directory, generates responses, then embeds each original prompt and both responses in Gemini API requests. Its comments state that raw prompts and replies never leave the machine, but `judge()` constructs exactly that outbound payload. No npm lifecycle hook triggers it automatically.

AI rationale

Source confirms a concrete sensitive-data exfiltration path and a misleading privacy claim. Absence of lifecycle execution reduces reach but does not negate the behavior.

Evidence

package.jsoneval/real-log-replay/run-replay.mjsinstall.mjsfusion/fusion-server.js/Users/elon/.claude/projects/**/*.jsonleval/real-log-replay/prompts.local.jsonleval/real-log-replay/raw.local/

Network endpoints1

generativelanguage.googleapis.com/v1beta/models/gemini-2.5-pro:generateContent

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

`eval/real-log-replay/run-replay.mjs` scans `/Users/elon/.claude/projects/**/*.jsonl` for real prompts.
Its default no-argument path runs extract, generation, and judging.
`judge()` sends each captured prompt and both replies to Gemini.
The source claims raw prompts never leave the machine, contradicting its request payload.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
Fusion networking is an explicitly registered optional MCP feature.
Installer mutations require an explicit `node install.mjs` command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 556 file(s), 1.24 MB of source, external domains: api.example.com, api.openai.com, generativelanguage.googleapis.com, github.com, openrouter.ai

Source & flagged code

10 flagged

claude-code/hooks/fable-update-check.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// fablever update-check — SessionStart hook. Tells the user (and the agent) when the installed clone is

3// behind the public GitHub repo, so the agent can summarize what changed and OFFER to update (never auto).

4//

5// DEFAULT-ON, but trivially disabled: FABLE_UPDATE_CHECK=off (this feature) or FABLE_PROFILE=off (all hooks),

6// or `node install.mjs --no-update-check` at install time.

7// Network footprint: the ONLY network it triggers is, at most once/24h, a detached `git ls-remote`

8// (anonymous — no credentials, no data sent, reads just the latest public commit hash). The hook itself

9// only READS a cached state file. FAIL-OPEN, NON-BLOCKING: any error prints nothing and exits 0.

10'use strict';

11const fs = require('fs');

12const os = require('os');

13const path = require('path');

14const { spawn } = require('child_process');

High

Child Process

Package source references child process execution.

claude-code/hooks/fable-update-check.jsView on unpkg · L13

16// locale for the VISIBLE cue only (we can't know the chat language before the user types).

17function detectLang() {

18 const env = (process.env.LANG || process.env.LC_ALL || process.env.LC_MESSAGES || '').split('.')[0].split('_')[0].toLowerCase();

19 if (env) return env;

20 try { return (Intl.DateTimeFormat().resolvedOptions().locale || '').split('-')[0].toLowerCase(); } catch { return ''; }

21}

22const CUE = {

23 ko: '🆕 fablever 업데이트가 있습니다 — 무엇이 바뀌었는지 물어보면 설명해 드리고, 업데이트할지 여쭤볼게요.',

24 ja: '🆕 fablever のアップデートがあります — 何が変わったか聞いてくれれば説明し、更新するか確認します。',

25 zh: '🆕 fablever 有可用更新 — 问我改了什么，我会说明并询问是否更新。',

26 es: '🆕 Hay una actualización de fablever — pregúntame qué cambió y te diré, y si quieres actualizar.',

27 fr: '🆕 Une mise à jour de fablever est disponible — demande-moi ce qui a changé ; je t\'expliquerai et te proposerai de mettre à jour.',

28 de: '🆕 Ein fablever-Update ist verfügbar — frag mich, was sich geändert hat; ich erkläre es und frage, ob du aktualisieren willst.',

29 pt: '🆕 Há uma atualização do fablever — pergunte o que mudou; eu explico e pergunto se quer atualizar.',

30 en: '🆕 A fablever update is available — ask me what changed and I\'ll explain, then offer to update.',

31};

33const q = p => (/[\s'"]/.test(p) ? JSON.stringify(p) : p);

install.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// install.mjs — the UNIVERSAL (cross-platform) Fable Profile installer.

3//

4// Works on macOS, Linux, AND native Windows (PowerShell/cmd, no WSL needed) — because everything

5// it touches is Node: it reuses claude-code/lib/settings-merge.js for the settings edits, copies the

High

Shell

Package source references shell execution.

install.mjsView on unpkg · L3

6// same Node hooks/MCP, and seeds the same config. `./install.sh` is the POSIX convenience wrapper;

7// this file is the one command that runs everywhere: node install.mjs

8//

eval/technique-ab/run-leadoutcome.mjsView file

43"Why might this sometimes return undefined?\n\nfunction first(a){ for(const x of a){ if(x>0) return x; } }", L44: "Is this safe to run in production? What's the risk?\n\napp.get('/run', (req,res)=>{ eval(req.query.cmd); res.end(); });", L45: "Does this correctly compute the average? What happens on an empty array?\n\nconst avg = a => a.reduce((x,y)=>x+y) / a.length;",

Low

Eval

Package source references a known benign dynamic code generation pattern.

eval/technique-ab/run-leadoutcome.mjsView on unpkg · L43

fusion/fusion-server.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict';

3/*

4 * fable-fusion MCP server — OPTIONAL, OFF BY DEFAULT, the one network-touching part of this project.

5 *

6 * Exposes a `fable_fusion` tool that sends a prompt to OpenRouter's Fusion API: a panel of models

7 * (default Opus + GPT + Gemini) answers in parallel, a judge compares them, and a final answer is

8 * synthesized — "Fable-like performance" by fusing several models. The fused answer is itself steered

9 * with the Fable working style (a system message from profiles/full.md), unless you disable that.

eval/real-log-replay/run-replay.mjsView file

Lines 1-34javascript

1// run-replay.mjs — Replay the operator's OWN real Claude Code prompts through plain Opus (B) vs fablever

2// (F) and blind-judge which reply they'd rather receive. The closest solo proxy to "real-user

3// productivity": instead of synthetic eval tasks, it samples the actual work distribution.

4//

5// PRIVACY (load-bearing): real prompts + both replies are written ONLY to prompts.local.jsonl and

6// raw.local/ which are gitignored. The committed RESULTS.md contains ONLY aggregate counts and

7// hand-written SYNTHETIC examples — no real prompt text, no project/client names ever leave the machine.

8//

9// HONEST SCOPE: we can only replay prompts that stand ALONE (no "fix that", no missing-file reference,

claude-code/hooks/fable-onboard.jsView file

Lines 3-43javascript

3//

4// CLAUDE CODE LIMITATION: a SessionStart hook CANNOT make the assistant speak first. `additionalContext`

5// is injected as a HIDDEN system reminder (model only) — nothing is shown to the user, and the assistant

6// emits no chat message until the user sends a first prompt. So we do two complementary things:

7// (1) a VISIBLE one-line cue via the `systemMessage` field (shown to the user at session start, in their

8// OS-locale language) telling them to send any message to begin setup; and

9// (2) the HIDDEN `additionalContext` instruction so that the moment the user sends ANY first message, the

10// agent runs the short setup before their task.

11// It shows on each fresh start until the user completes OR skips setup (the agent writes the 'onboarded'

eval/xverify-value/run-xverify.mjsView file

Lines 164-204javascript

164 ] },

165 { id: 'sub_async', code:

166`function loadAll(ids) {

167 const out = [];

168 ids.forEach(async id => { out.push(await get(id)); });

169 return out;

170}`,

171 defects: [

claude-code/hooks/fable-reinject.shView file

•path = claude-code/hooks/fable-reinject.sh kind = build_helper sizeBytes = 4160 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

claude-code/hooks/fable-reinject.shView on unpkg

Source & flagged code

10 flagged · loading source

claude-code/hooks/fable-update-check.jsView file

13const path = require('path'); L14: const { spawn } = require('child_process'); L15:

High

Child Process

Package source references child process execution.

claude-code/hooks/fable-update-check.jsView on unpkg · L13

install.mjsView file

3// L4: // Works on macOS, Linux, AND native Windows (PowerShell/cmd, no WSL needed) — because everything L5: // it touches is Node: it reuses claude-code/lib/settings-merge.js for the settings edits, copies the

High

Shell

Package source references shell execution.

install.mjsView on unpkg · L3

eval/technique-ab/run-leadoutcome.mjsView file

Findings

1 Critical4 High6 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationeval/real-log-replay/run-replay.mjs

HighChild Processclaude-code/hooks/fable-update-check.js

HighShellinstall.mjs

HighSame File Env Network Executioneval/xverify-value/run-xverify.mjs

HighCommand Output Exfiltrationeval/xverify-value/run-xverify.mjs

MediumDynamic Requirefusion/fusion-server.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceclaude-code/hooks/fable-onboard.js

MediumShips Build Helperclaude-code/hooks/fable-reinject.sh

MediumStructural Risk Force Deep Review

LowScripts Present

Low

Affected versions and remediation

This report applies to fablever@1.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing fablever@1.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-03 14:06:58.265Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.3.0latestshownMaliciousData ExfiltrationBlockPublishedJul 2, 2026, 1:31 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code