registry / mobbdev / 1.5.4

mobbdev@1.5.4

Automated secure code remediation tool

AI Security Review

scanned 29d ago · by lpm-firewall-ai

The package is a Mobb remediation CLI whose agent hooks are first-party and command-gated, but those commands persist broad Claude and Codeium hooks that respawn mobbdev@latest and upload session context. Postinstall also pulls a remote Checkmarx binary, so the combined capability is a warning rather than a silent install-time hijack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall for the Checkmarx binary; user commands claude-code-install-hook and windsurf-intellij-install-hook, then later Claude PostToolUse or the daemon.

Impact

A consented hook keeps a background Mobb collector on the machine and sends Claude session material to the vendor. The install-time download executes only the extracted Checkmarx scanner binary in the package bin directory.

Mechanism

Hook installers write home-directory agent settings that launch npx mobbdev@latest. The daemon refreshes ~/.claude/settings.json and uploads transcripts and context after Mobb authentication. Postinstall streams a pinned GitHub archive and extracts cx into node_modules/.bin.

AI rationale

Evidence

package.jsonsrc/post_install/cx_install.mjssrc/post_install/binary.mjsdist/index.mjsnode_modules/.bin~/.claude/settings.json~/.mobbdev~/.codeium/hooks.json

Network endpoints2

github.com/Checkmarx/ast-cli/releases/download/2.0.55/api.mobb.ai/v1/graphql

Decision evidence

public snapshot

AI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

postinstall runs src/post_install/cx_install.mjs, which downloads a pinned Checkmarx ast-cli archive and extracts the scanner binary into node_modules/.bin.
The claude-code-install-hook command writes a PostToolUse command hook into the user home Claude settings file.
That hook and the daemon shim spawn npx --yes mobbdev@latest claude-code-daemon, and the daemon widens an existing Mobb matcher to * then rewrites the settings file.
The windsurf-intellij-install-hook command writes ~/.codeium/hooks.json so post_write_code runs npx --yes mobbdev@latest windsurf-intellij-process-hook.
After authentication the Claude daemon uploads session transcripts, context files, and skills to the Mobb upload pipeline.

Evidence against

Hook installation is a named CLI command that first authenticates to the Mobb GraphQL API; npm postinstall does not write Claude or Codeium config.
The Checkmarx download uses a fixed GitHub release URL, installs only the cx binary, and skips the download when that binary already exists.
API_URL in .env points at https://api.mobb.ai/v1/graphql, matching the package vendor, and the bundled SCM tokens are empty.

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node ./src/post_install/cx_install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

.envView file

4patternName = blocked_file severity = critical blockedFile = .env redactedSecretContext = secretLikeLines = 5 L4: GITLAB_API_TOKEN=<redacted:0 empty> L5: GITHUB_API_TOKEN=<redacted:0 empty> L6: ADO_TEST_ACCESS_TOKEN=<redacted:0 empty> L7: HASURA_ACCESS_KEY=<redacted:0 empty> L10: DD_RUM_TOKEN=<redacted:35 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = mobbdev@1.5.17 matchedIdentity = npm:bW9iYmRldg:1.5.17 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

12894// src/utils/computerName.ts L12895: import { execSync } from "child_process"; L12896: import os from "os";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L12894

19623// src/features/claude_code/daemon-check-shim.tmpl.js L19624: var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\... L19625:

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L19623

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs2.writeFileSync(gitignorePath, updatedContent, "utf8"); appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/fix/${fixId}`; appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/issue/${issueId}`; appBaseUrl, appBaseUrl, appBaseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

118Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L119: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L120: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L377: patch L378: patchOriginalEncodingBase64 L379: questions { ... L1141: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1142: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1143: __typename ... L1737: const { url } = sourceCodeFile.signedFile; L1738: const sourceCodeRes = await fetch(url).catch(() => null); L1739: if (!sourceCodeRes?.ok) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L118

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.mjsView on unpkg · L118

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L19623

•matchType = token_shingles matchedPackage = mobbdev@1.5.18 matchedPath = dist/args/commands/upload_ai_blame.mjs matchedIdentity = npm:bW9iYmRldg:1.5.18 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

4334const buildPath = "../../../../../[redacted]"; L4335: module = await import(buildPath); L4336: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L4334

10804try { L10805: const getImportMetaUrl = new Function("return import.meta.url"); L10806: const importMetaUrl = getImportMetaUrl();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L10804

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L118

dist/hash_search/index.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hash_search/index.mjsView on unpkg

dist/args/commands/upload_ai_blame.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/args/commands/upload_ai_blame.mjsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/post_install/cx_install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

.envView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

Findings

2 Critical10 High4 Medium6 Low

CriticalCritical Secret.env

CriticalPrevious Version Dangerous Deltadist/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.mjs

HighShelldist/index.mjs

HighCredential Redirect Persistencedist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

HighObfuscated Payload Loaderdist/index.mjs

HighRuntime Package Installdist/index.mjs

HighSemantic Analysis Limiteddist/hash_search/index.mjs

HighKnown Malware Source Similaritydist/index.mjs

HighKnown Malware Source Similaritydist/args/commands/upload_ai_blame.mjs

Affected versions and remediation

This report applies to mobbdev@1.5.4.

See all versions of mobbdev for other recorded verdicts.

Review the evidence and your use of mobbdev@1.5.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-24 00:44:41.794Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code