registry / vibe-lm / 0.2.7

vibe-lm@0.2.7

A comprehensive set of agentic tools for LM Studio: file operations, web fetching/search, memory, SSH, and an autonomous vibe_bridge keep-alive loop.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 467 KB of source, external domains: example.com, one.com, search.example.com, two.com

Source & flagged code

9 flagged

dist/toolsProvider.jsView file

Lines 51-91javascript

51exports.resultCharBudget = resultCharBudget;

52exports.distillToolFact = distillToolFact;

53exports.webSearch = webSearch;

54exports.binaryExtCheck = binaryExtCheck;

55exports.pickBestModel = pickBestModel;

56exports.checkBashCommandSafety =

Source & flagged code

9 flagged · loading source

dist/toolsProvider.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = vibe-lm@0.2.6 matchedIdentity = npm:dmliZS1sbQ:0.2.6 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/toolsProvider.jsView on unpkg

71const toolSettings_1 = require("./toolSettings"); L72: const LMSTUDIO_API_PORT = process.env.LMSTUDIO_API_PORT || "1234"; L73: const API_BASE = `http://localhost:${LMSTUDIO_API_PORT}`; L74: // Persistent runtime data lives under extensions/data, NOT extensions/plugins — `lms dev --install` ... L311: } L312: const data = await resp.json(); L313: if (!data?.data?.length) { ... L1117: // Classify a tool result into a coarse outcome plus a short human-readable detail. Shell tools report L1118: // success/failure through the command's exitCode (a failed command still returns ok:true at the tool L1119: // layer), so they're inspected specially; everything else keys off the tool's own ok flag. ... L1529: ok: true, L1530: data: {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/toolsProvider.jsView on unpkg · L71

tests/test_build.shView file

•path = tests/test_build.sh kind = payload_in_excluded_dir sizeBytes = 1418 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_build.shView on unpkg

•path = tests/test_build.sh kind = build_helper sizeBytes = 1418 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tests/test_build.shView on unpkg

release/vibeLM-v0.2.7.zipView file

•path = release/vibeLM-v0.2.7.zip kind = high_entropy_blob sizeBytes = 152328 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

release/vibeLM-v0.2.7.zipView on unpkg

•path = release/vibeLM-v0.2.7.zip kind = compressed_blob sizeBytes = 152328 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

release/vibeLM-v0.2.7.zipView on unpkg

•path = release/vibeLM-v0.2.7.zip kind = nested_archive_needs_inspection sizeBytes = 152328 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

release/vibeLM-v0.2.7.zipView on unpkg

tests/cascade.test.tsView file

464patternName = generic_password severity = medium line = 464 matchedText = { host: ..." },

Medium

Secret Pattern

Hardcoded password in tests/cascade.test.ts

tests/cascade.test.tsView on unpkg · L464

tests/tools.test.tsView file

153patternName = generic_password severity = medium line = 153 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in tests/tools.test.ts

tests/tools.test.tsView on unpkg · L153

Findings

3 High8 Medium5 Low

HighShips High Entropy Blobrelease/vibeLM-v0.2.7.zip

HighPayload In Excluded Dirtests/test_build.sh

HighPrevious Version Dangerous Deltadist/toolsProvider.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/toolsProvider.js

MediumShips Build Helpertests/test_build.sh

MediumShips Compressed Blobrelease/vibeLM-v0.2.7.zip

MediumStructural Risk Force Deep Review

MediumSecret Patterntests/cascade.test.ts

MediumSecret Patterntests/tools.test.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionrelease/vibeLM-v0.2.7.zip

tests/cascade.test.tsView file

Lines 444-484typescript

444

445 // Successful calls are keyed on their exact signature (not the coarse program name), so distinct

446 // successes are each kept rather than collapsed — the fact tag therefore embeds the full command.

447 const echoOk = mems.filter((m: any) => /bash_terminal `echo vibelm-ok` → ok/.test(m.content));

448 assert.equal(echoOk.length, 1, "a successful command records its own outcome fact");

449 assert.ok((echoOk[0].tags || []).some((t: string) => t.startsWith("fact:bash_terminal:") && t.endsWith(":ok")), "success fact is tagged with an ok-outcome key");

450 });

451

452 it("keeps distinct successful commands as separate facts but never leaks secret args into the fact key", async () => {

453 const { distillToolFact } = await import("../src/toolsProvider");

454

455 // Distinct successful commands must not collapse (regression caught in live testing).

456 const a = distillToolFact("bash_terminal", { command: "cat a.txt" }, { ok: true, data: { exitCode: 0, stdout: "ALPHA", stderr: "" } });

457 const b = distillToolFact("bash_terminal", { command: "cat b.txt" }, { ok: true, data: { exitCode: 0, stdout: "BRAVO", stderr: "" } });

458 assert.notEqual(a.key, b.key, "distinct successful commands must get distinct dedupe keys");

459

460 // A secret arg (ssh_exec password) must never appear in the key — the key is persisted as a

461 // memory tag, so the success key is a hash of the signature, not the raw args.

462 const s = distillToolFact(

463 "ssh_exec",

464 { host: "h", user: "u", password: "SUPERSECRET123", command: "whoami" },

Medium

Secret Pattern

Hardcoded password in tests/cascade.test.ts

tests/cascade.test.tsView on unpkg · L464

465 { ok: true, data: { exitCode: 0, stdout: "root", stderr: "" } },

466 );

467 assert.ok(!s.key.includes("SUPERSECRET123"), "the fact key must not embed the password");

468 assert.ok(!s.fact.includes("SUPERSECRET123"), "the fact text must not embed the password");

469 });

470

471 it("buildContextSpine pins goal + plan + facts as the head (cut-the-middle retention)", async () => {

472 const { buildContextSpine } = await import("../src/toolsProvider");

473 const { SessionLog } = await import("../src/sessionLog");

474 const logPath = resolve(CONFIG_DIR, `spine-${Date.now()}.jsonl`);

475 const log = new SessionLog(logPath);

476 const sid = "spine-sess";

477 log.saveMemory(["fact:bash_terminal:ls:fail", `session:${sid}`], "bash_terminal `ls /x` → failed: not found", 1, sid, "/ws", "workspace");

478 log.saveMemory(["fact:bash_terminal:#abc:ok", `session:${sid}`], "bash_terminal `cat a.txt` → ok: ALPHA-DATA", 2, sid, "/ws", "workspace");

479

480 const state: any = {

481 sessionId: sid,

482 plan: {

483 goal: "Build the widget",

484 steps: [

tests/tools.test.tsView file

Lines 133-173typescript

133});

134

135describe("ssh_exec injection safety", () => {

136 const workDir = join(tmpdir(), "vibe-lm-ssh-test-" + Date.now());

137 before(() => { if (!existsSync(workDir)) mkdirSync(workDir, { recursive: true }); });

138 after(() => rmSync(workDir, { recursive: true, force: true }));

139

140 it("does not allow local shell injection via host or user", async () => {

141 const sentinel = join(tmpdir(), `ssh-injection-test-${Date.now()}.txt`);

142 const { toolsProvider } = await import("../src/toolsProvider");

143 const tools = await toolsProvider({

144 getWorkingDirectory: () => workDir,

145 getPluginConfig: () => ({ get: (key: string) => (key === "tools.ssh_exec" ? true : undefined) }),

146 } as any);

147 const ssh = tools.find((t: any) => t.name === "ssh_exec");

148 assert.ok(ssh, "ssh_exec tool must be present");

149

150 await ssh.implementation({

151 host: `x; touch ${sentinel} #`,

152 user: "root",

153 password: "irrelevant",

Medium

Secret Pattern

Hardcoded password in tests/tools.test.ts

tests/tools.test.tsView on unpkg · L153

154 command: "true",

155 });

156

157 assert.equal(existsSync(sentinel), false, "a malicious host value must not execute a local shell command");

158 });

159});

160

161describe("pickBestModel and VLM_PATTERNS", () => {

162 it("treats glm vision variants as multimodal models", async () => {

163 const { VLM_PATTERNS, pickBestModel } = await import("../src/toolsProvider");

164 assert.equal(VLM_PATTERNS.test("zai-org/glm-4.6v-flash"), true);

165 assert.equal(VLM_PATTERNS.test("qwen/qwen3-4b"), false);

166

167 const chosen = pickBestModel(

168 [{ id: "zai-org/glm-4.6v-flash" }, { id: "qwen/qwen3-4b" }],

169 undefined,

170 );

171 assert.equal(chosen, "qwen/qwen3-4b");

172 });

173});