registry / Data exfiltration / mobbdev

mobbdev

Automated secure code remediation tool

This report shows the evidence for mobbdev@1.5.18. 1 of 14 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package implements concrete persistent agent-data collection and upload behavior, plus a latest-version self-install path and an automatic external binary download. The explicit hook-install command reduces accidental activation but does not remove the demonstrated exfiltration and persistence chain.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation triggers the binary download; explicit Claude or Windsurf hook setup triggers persistent processing on later agent events.

Impact

Agent transcripts, prompts, inferences, workspace context, and bundled credentials can be exposed; later package releases execute through the persistent hook.

Mechanism

Persistent AI-agent hooks launch latest-package code and upload collected context.

Attack narrative

The package runs a postinstall downloader that places a remote executable in the consumer project. Its explicit hook commands modify global Claude and Windsurf configuration, creating persistent hooks. The Claude hook launches a detached npx mobbdev@latest daemon, so future releases can run automatically. That daemon scans Claude-related context and uploads files, prompts, and inferences to remote upload URLs. The package also ships a production-style environment file containing credential assignments.

AI rationale

Evidence

.envpackage.jsonsrc/post_install/cx_install.mjsdist/index.mjsnode_modules/.bin/cx~/.claude/settings.json~/.mobbdev/daemon-check.js~/.codeium/hooks.json

Network endpoints2

github.comapi.mobb.ai

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The published .env contains production-style credential assignments.
The automatic postinstall downloads and extracts an external executable into node_modules/.bin without an integrity check.
An installed Claude hook starts a detached npx process for mobbdev@latest, allowing later releases to run automatically.
Hook processing collects Claude workspace context, prompts, and inferences, then uploads them to server-provided URLs.

Evidence against

Claude hook installation is initiated by an explicit CLI command and performs authentication first.
The postinstall download is fixed to a Checkmarx release URL and is limited to a named binary.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

12 flagged

package.jsonView file

Lines 1-31json

2 "name": "mobbdev",

3 "version": "1.5.18",

4 "description": "Automated secure code remediation tool",

5 "repository": "git+https://github.com/mobb-dev/bugsy.git",

6 "main": "dist/index.mjs",

7 "module": "dist/index.mjs",

8 "scripts": {

9 "clean": "rm -rf build",

10 "env": "dotenv -e ./.env",

11 "postinstall": "node ./src/post_install/cx_install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "build": "tsc && tsup-node --env.NODE_ENV production",

13 "build:dev": "tsup-node --env.NODE_ENV development",

14 "build:binary": "node ./scripts/build_binary.mjs",

15 "build:binary:all": "node ./scripts/build_binary.mjs --all",

16 "increment-version": "./scripts/increment-version.sh",

17 "test:unit:mcp": "vitest run __tests__/mcp/",

18 "test:unit:mcp:ci": "vitest run --bail=1 __tests__/mcp/",

19 "test:mcp:watch": "vitest watch __tests__/mcp/",

20 "test:mcp:verbose": "pnpm run build && NODE_ENV=test VERBOSE=true vitest run __tests__/mcp/",

21 "test:mcp:all": "pnpm run test:unit:mcp && pnpm run test:integration:mcp && pnpm run test:e2e:mcp",

22 "test:unit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

23 "test:unit:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

24 "test:integration": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.test.ts",

25 "test:integration:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.test.ts",

26 "test:integration:baseline-commit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

27 "test:integration:baseline-commit:proxy": "GIT_PROXY_HOST=http://tinyproxy:8888 HTTP_PROXY=http://localhost:8888 API_URL=http://app-api:8080/v1/graphql TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

28 "test:integration:mcp": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

29 "test:integration:mcp:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

30 "test:integration:watch": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest watch run __tests__/integration.test.ts",

31 "test": "pnpm run test:unit && pnpm run test:integration",

.envView file

Lines 1-10text

1# production@v21

2API_URL="https://api.mobb.ai/v1/graphql"

3WEB_APP_URL="https://app.mobb.ai"

4GITLAB_API_TOKEN=""

5GITHUB_API_TOKEN=""

6ADO_TEST_ACCESS_TOKEN=""

7HASURA_ACCESS_KEY=""

8LOCAL_GRAPHQL_ENDPOINT=""

9GIT_PROXY_HOST="http://tinyproxy:8888"

10DD_RUM_TOKEN="pubf59c0182545bfb4c299175119f1abf9b"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

13322// src/utils/computerName.ts L13323: import { execSync } from "child_process"; L13324: import os from "os";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L13322

20212// src/features/claude_code/daemon-check-shim.tmpl.js L20213: var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\... L20214:

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L20212

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs2.writeFileSync(gitignorePath, updatedContent, "utf8"); appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/fix/${fixId}`; appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/issue/${issueId}`; appBaseUrl, appBaseUrl, appBaseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

118Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L119: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L120: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L378: patch L379: patchOriginalEncodingBase64 L380: questions { ... L1144: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1145: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1146: __typename ... L1744: const { url } = sourceCodeFile.signedFile; L1745: const sourceCodeRes = await fetch(url).catch(() => null); L1746: if (!sourceCodeRes?.ok) {

dist/hash_search/index.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hash_search/index.mjsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/post_install/cx_install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

.envView file

4patternName = blocked_file severity = critical blockedFile = .env redactedSecretContext = secretLikeLines = 5 L4: GITLAB_API_TOKEN=<redacted:0 empty> L5: GITHUB_API_TOKEN=<redacted:0 empty> L6: ADO_TEST_ACCESS_TOKEN=<redacted:0 empty> L7: HASURA_ACCESS_KEY=<redacted:0 empty> L10: DD_RUM_TOKEN=<redacted:35 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

13322// src/utils/computerName.ts L13323: import { execSync } from "child_process"; L13324: import os from "os";

Findings

1 Critical8 High4 Medium6 Low

CriticalCritical Secret.env

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.mjs

HighShelldist/index.mjs

HighCredential Redirect Persistencedist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

HighObfuscated Payload Loaderdist/index.mjs

HighRuntime Package Installdist/index.mjs

HighSemantic Analysis Limiteddist/hash_search/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to mobbdev@1.5.18.

The versions list below shows the verdict for each recorded version.

Avoid installing mobbdev@1.5.18. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-31 16:53:13.897Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

14 known versions

1.5.18latestshownMaliciousData ExfiltrationBlockPublishedAug 31, 2026, 3:44 PM 1.5.17SuspiciousAI-agent capability abuseWarnPublishedAug 31, 2026, 7:07 AM 1.5.16SuspiciousStaged Payload CarrierWarnPublishedAug 28, 2026, 3:08 PM 1.5.5SuspiciousAI-agent capability abuseWarnPublishedAug 25, 2026, 5:07 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code