cue-ai flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/incidentsfield log

cue-ai flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

// offending code· 3 files flaggedpatterns: 11

--- install scripts ---
### postinstall
echo '' && echo '  ✅ cue installed.' && echo '  Next: run `cue shell install`  (activates the claude/codex shim — required to load profiles)' && echo '        then `cue init`        (pin a profile to this directory)' && echo '  Docs: https://github.com/opencue/cuecards' && echo ''

### prepack
bash scripts/prepack-check.sh && bun run build:bundle



--- package/get.sh (excerpt) ---
#!/usr/bin/env bash
# cue — one-line installer
#
# Usage:
#   curl -fsSL https://raw.githubusercontent.com/opencue/claude-code-skills/main/get.sh | bash
#   curl -fsSL https://raw.githubusercontent.com/opencue/claude-code-skills/main/get.sh | bash -s -- --yes
#
# Environment variables:
#   CUE_DIR     — where to clone (default: ~/Documents/cue)
#   CUE_BRANCH  — git branch to clone (default: main)

set -euo pipefail

CUE_DIR="${CUE_DIR:-$HOME/Documents/cue}"
CUE_BRANCH="${CUE_BRANCH:-main}"
CUE_REPO="https://github.com/opencue/claude-code-skills.git"

# Colors
if [ -t 2 ] && [ -t 1 ]; then
  ORANGE='\033[38;5;208m'
  GREEN='\033[38;5;82m'
  CYAN='\033[38;5;81m'
  DIM='\033[2m'
  BOLD='\033[1m'
  RED='\033[38;5;196m'
  YELLOW='\033[38;5;220m'
  RESET='\033[0m'
  BG='\033[48;5;235m'
else
  ORANGE='' GREEN='' CYAN='' DIM='' BOLD='' RED='' YELLOW='' RESET='' BG=''
fi

say()  { printf '%s\n' "$*" >&2; }
ok()   { say "  ${GREEN}✓${RESET} $*"; }
warn() { say "  ${YELLOW}⚠${RESET} $*"; }
err()  { say "  ${RED}✗${RESET} $*"; }
die()  { err "$*"; exit 1; }
step() { say ""; say "${ORANGE}━━━ $1 ━━━${RESET}"; }

# Banner
say ""
say "${ORANGE}   ██████╗██╗   ██╗███████╗${RESET}"
say "${ORANGE}  ██╔════╝██║   ██║██╔════╝${RESET}"
say "${ORANGE}  ██║     ██║   ██║█████╗  ${RESET}"
say "${ORANGE}  ██║     ██║   ██║██╔══╝  ${RESET}"
say "${ORANGE}  ╚██████╗╚██████╔╝███████╗${RESET}"
say "${ORANGE}   ╚═════╝ ╚═════╝ ╚══════╝${RESET}"
say ""
say "  ${BOLD}Agent Profile Manager${RESET} for Claud

--- package/package.json (excerpt) ---
{
  "name": "cue-ai",
  "version": "0.9.2",
  "description": "cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.",
  "type": "module",
  "bin": {
    "cue": "bin/cue.mjs"
  },
  "engines": {
    "node": ">=20.0.0"
  },
  "scripts": {
    "cue": "bun src/index.ts",
    "test": "bun test",
    "typecheck": "tsc --noEmit",
    "lint": "biome lint src",
    "build": "bun build src/index.ts --no-bundle",
    "build:bundle": "bun build src/index.ts --target=node --outfile=dist/cue.js",
    "prepack": "bash scripts/prepack-check.sh && bun run build:bundle",
    "postinstall": "echo '' && echo '  ✅ cue installed.' && echo '  Next: run `cue shell install`  (activates the claude/codex shim — required to load profiles)' && echo '        then `cue init`        (pin a profile to this directory)' && echo '  Docs: https://github.com/opencue/cuecards' && echo ''"
  },
  "keywords": [
    "claude-code",
    "codex",
    "agent",
    "profile",
    "profile-manager",
    "skills",
    "claude-skill",
    "agent-skill",
    "mcp",
    "mcp-server",
    "ai",
    "ai-agents",
    "ai-coding",
    "anthropic",
    "claude",
    "cli",
    "developer-tools"
  ],
  "author": "NagyVikt",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "https://github.com/opencue/cuecards.git"
  },
  "homepage": "https://github.com/opencue/cuecards",
  "bugs": {
    "url": "https://github.com/opencue/cuecards/issues"
  },
  "files"

--- package/src/index.ts (excerpt) ---
#!/usr/bin/env bun
/**
 * cue CLI entrypoint.
 *
 * Pure dispatch: parse the leading flags (--help, --version), pick a
 * subcommand from the registry in commands/_index.ts, and hand the rest of
 * argv to that command's `run(args)`. All real logic lives in command modules.
 *
 * Exit codes:
 *   0  success
 *   1  user error (unknown command, bad args, missing profile)
 *   2  internal error (uncaught exception, missing dep)
 */
import { readFileSync } from "node:fs";
import { fileURLToPath } from "node:url";
import { dirname, resolve } from "node:path";
import { COMMANDS, type CommandName } from "./commands/_index";

const HERE = dirname(fileURLToPath(import.meta.url));
const REPO_ROOT = process.env.CUE_REPO_ROOT ?? process.env.SOUL_REPO_ROOT ?? resolve(HERE, "..");

function readVersion(): string {
  try {
    const pkg = JSON.parse(
      readFileSync(resolve(REPO_ROOT, "package.json"), "utf8"),
    ) as { version?: string };
    return pkg.version ?? "0.0.0";
  } catch {
    return "0.0.0";
  }
}

function printHelp(): void {
  const groups: Record<string, [string, string][]> = {
    "Profile Management": [
      ["list", "List available profiles"],
      ["use", "Activate a profile for the current directory"],
      ["current", "Show the active profile"],
      ["tui", "Three-pane interactive viewer: profiles, skills, preview"],
      ["new", "Scaffold a new profile"],
      ["create-profile", "Create profile from skills/MCPs list"],
      ["icon", "Pick an emoji icon f

@0.9.0·2026-06-01·AUTO-PUBLISHED·publisher: imdeadpool

heuristic 80/100

static flags 10

llm malicious (0.95) via fast-track

install-scripts:postinstalltarball-size-jump:9xnew-publisher:8dhas-source-repoai-agent-frameworkpublic-github-pushcurl-pipe-bashbun-runtime-bootstrapreads-env-varschild-process-spawnreads-mcp-configfs-recursive-readclaude-agent-config-injectionpy-pip-install-runtimebase64-decode

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

// offending code· 3 files flaggedpatterns: 10

--- install scripts ---
### postinstall
echo '' && echo '  ✅ cue installed. Run: cue init' && echo '  Docs: https://github.com/opencue/claude-code-skills' && echo ''

### prepack
bash scripts/prepack-check.sh && bun run build:bundle



--- package/get.sh (excerpt) ---
#!/usr/bin/env bash
# cue — one-line installer
#
# Usage:
#   curl -fsSL https://raw.githubusercontent.com/opencue/claude-code-skills/main/get.sh | bash
#   curl -fsSL https://raw.githubusercontent.com/opencue/claude-code-skills/main/get.sh | bash -s -- --yes
#
# Environment variables:
#   CUE_DIR     — where to clone (default: ~/Documents/cue)
#   CUE_BRANCH  — git branch to clone (default: main)

set -euo pipefail

CUE_DIR="${CUE_DIR:-$HOME/Documents/cue}"
CUE_BRANCH="${CUE_BRANCH:-main}"
CUE_REPO="https://github.com/opencue/claude-code-skills.git"

# Colors
if [ -t 2 ] && [ -t 1 ]; then
  ORANGE='\033[38;5;208m'
  GREEN='\033[38;5;82m'
  CYAN='\033[38;5;81m'
  DIM='\033[2m'
  BOLD='\033[1m'
  RED='\033[38;5;196m'
  YELLOW='\033[38;5;220m'
  RESET='\033[0m'
  BG='\033[48;5;235m'
else
  ORANGE='' GREEN='' CYAN='' DIM='' BOLD='' RED='' YELLOW='' RESET='' BG=''
fi

say()  { printf '%s\n' "$*" >&2; }
ok()   { say "  ${GREEN}✓${RESET} $*"; }
warn() { say "  ${YELLOW}⚠${RESET} $*"; }
err()  { say "  ${RED}✗${RESET} $*"; }
die()  { err "$*"; exit 1; }
step() { say ""; say "${ORANGE}━━━ $1 ━━━${RESET}"; }

# Banner
say ""
say "${ORANGE}   ██████╗██╗   ██╗███████╗${RESET}"
say "${ORANGE}  ██╔════╝██║   ██║██╔════╝${RESET}"
say "${ORANGE}  ██║     ██║   ██║█████╗  ${RESET}"
say "${ORANGE}  ██║     ██║   ██║██╔══╝  ${RESET}"
say "${ORANGE}  ╚██████╗╚██████╔╝███████╗${RESET}"
say "${ORANGE}   ╚═════╝ ╚═════╝ ╚══════╝${RESET}"
say ""
say "  ${BOLD}Agent Profile Manager${RESET} for Claud

--- package/package.json (excerpt) ---
{
  "name": "cue-ai",
  "version": "0.9.0",
  "description": "cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.",
  "type": "module",
  "bin": {
    "cue": "bin/cue.mjs"
  },
  "engines": {
    "node": ">=20.0.0"
  },
  "scripts": {
    "cue": "bun src/index.ts",
    "test": "bun test",
    "typecheck": "tsc --noEmit",
    "build": "bun build src/index.ts --no-bundle",
    "build:bundle": "bun build src/index.ts --target=node --outfile=dist/cue.js",
    "prepack": "bash scripts/prepack-check.sh && bun run build:bundle",
    "postinstall": "echo '' && echo '  ✅ cue installed. Run: cue init' && echo '  Docs: https://github.com/opencue/claude-code-skills' && echo ''"
  },
  "keywords": [
    "claude-code",
    "codex",
    "agent",
    "profile",
    "skills",
    "mcp",
    "ai",
    "cli",
    "developer-tools"
  ],
  "author": "NagyVikt",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "https://github.com/opencue/claude-code-skills.git"
  },
  "homepage": "https://github.com/opencue/claude-code-skills",
  "bugs": {
    "url": "https://github.com/opencue/claude-code-skills/issues"
  },
  "files": [
    "bin/",
    "dist/",
    "src/",
    "profiles/*/profile.yaml",
    "profiles/*/logo.png",
    "profiles/*/README.md",
    "profiles/_types.ts",
    "profiles/schema.json",
    "profiles/SCHEMA.md",
    "profiles/README.md",
    "resources/skills/skills/",
    "resources/skills/README.md",
  

--- package/src/index.ts (excerpt) ---
#!/usr/bin/env bun
/**
 * cue CLI entrypoint.
 *
 * Pure dispatch: parse the leading flags (--help, --version), pick a
 * subcommand from the registry in commands/_index.ts, and hand the rest of
 * argv to that command's `run(args)`. All real logic lives in command modules.
 *
 * Exit codes:
 *   0  success
 *   1  user error (unknown command, bad args, missing profile)
 *   2  internal error (uncaught exception, missing dep)
 */
import { readFileSync } from "node:fs";
import { fileURLToPath } from "node:url";
import { dirname, resolve } from "node:path";
import { COMMANDS, type CommandName } from "./commands/_index";

const HERE = dirname(fileURLToPath(import.meta.url));
const REPO_ROOT = process.env.CUE_REPO_ROOT ?? process.env.SOUL_REPO_ROOT ?? resolve(HERE, "..");

function readVersion(): string {
  try {
    const pkg = JSON.parse(
      readFileSync(resolve(REPO_ROOT, "package.json"), "utf8"),
    ) as { version?: string };
    return pkg.version ?? "0.0.0";
  } catch {
    return "0.0.0";
  }
}

function printHelp(): void {
  const groups: Record<string, [string, string][]> = {
    "Profile Management": [
      ["list", "List available profiles"],
      ["use", "Activate a profile for the current directory"],
      ["current", "Show the active profile"],
      ["tui", "Three-pane interactive viewer: profiles, skills, preview"],
      ["new", "Scaffold a new profile"],
      ["create-profile", "Create profile from skills/MCPs list"],
      ["icon", "Pick an emoji icon f

// install scripts

// package/get.sh (excerpt)

#!/usr/bin/env bash
# cue — one-line installer
#
# Usage:
#   curl -fsSL https://raw.githubusercontent.com/opencue/claude-code-skills/main/get.sh | bash
#   curl -fsSL https://raw.githubusercontent.com/opencue/claude-code-skills/main/get.sh | bash -s -- --yes
#
# Environment variables:
#   CUE_DIR     — where to clone (default: ~/Documents/cue)
#   CUE_BRANCH  — git branch to clone (default: main)

set -euo pipefail

CUE_DIR="${CUE_DIR:-$HOME/Documents/cue}"
CUE_BRANCH="${CUE_BRANCH:-main}"
CUE_REPO="https://github.com/opencue/claude-code-skills.git"

# Colors
if [ -t 2 ] && [ -t 1 ]; then
  ORANGE='\033[38;5;208m'
  GREEN='\033[38;5;82m'
  CYAN='\033[38;5;81m'
  DIM='\033[2m'
  BOLD='\033[1m'
  RED='\033[38;5;196m'
  YELLOW='\033[38;5;220m'
  RESET='\033[0m'
  BG='\033[48;5;235m'
else
  ORANGE='' GREEN='' CYAN='' DIM='' BOLD='' RED='' YELLOW='' RESET='' BG=''
fi

say()  { printf '%s\n' "$*" >&2; }
ok()   { say "  ${GREEN}✓${RESET} $*"; }
warn() { say "  ${YELLOW}⚠${RESET} $*"; }
err()  { say "  ${RED}✗${RESET} $*"; }
die()  { err "$*"; exit 1; }
step() { say ""; say "${ORANGE}━━━ $1 ━━━${RESET}"; }

# Banner
say ""
say "${ORANGE}   ██████╗██╗   ██╗███████╗${RESET}"
say "${ORANGE}  ██╔════╝██║   ██║██╔════╝${RESET}"
say "${ORANGE}  ██║     ██║   ██║█████╗  ${RESET}"
say "${ORANGE}  ██║     ██║   ██║██╔══╝  ${RESET}"
say "${ORANGE}  ╚██████╗╚██████╔╝███████╗${RESET}"
say "${ORANGE}   ╚═════╝ ╚═════╝ ╚══════╝${RESET}"
say ""
say "  ${BOLD}Agent Profile Manager${RESET} for Claud

// package/package.json (excerpt)

{
  "name": "cue-ai",
  "version": "0.9.2",
  "description": "cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.",
  "type": "module",
  "bin": {
    "cue": "bin/cue.mjs"
  },
  "engines": {
    "node": ">=20.0.0"
  },
  "scripts": {
    "cue": "bun src/index.ts",
    "test": "bun test",
    "typecheck": "tsc --noEmit",
    "lint": "biome lint src",
    "build": "bun build src/index.ts --no-bundle",
    "build:bundle": "bun build src/index.ts --target=node --outfile=dist/cue.js",
    "prepack": "bash scripts/prepack-check.sh && bun run build:bundle",
    "postinstall": "echo '' && echo '  ✅ cue installed.' && echo '  Next: run `cue shell install`  (activates the claude/codex shim — required to load profiles)' && echo '        then `cue init`        (pin a profile to this directory)' && echo '  Docs: https://github.com/opencue/cuecards' && echo ''"
  },
  "keywords": [
    "claude-code",
    "codex",
    "agent",
    "profile",
    "profile-manager",
    "skills",
    "claude-skill",
    "agent-skill",
    "mcp",
    "mcp-server",
    "ai",
    "ai-agents",
    "ai-coding",
    "anthropic",
    "claude",
    "cli",
    "developer-tools"
  ],
  "author": "NagyVikt",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "https://github.com/opencue/cuecards.git"
  },
  "homepage": "https://github.com/opencue/cuecards",
  "bugs": {
    "url": "https://github.com/opencue/cuecards/issues"
  },
  "files"

// package/src/index.ts (excerpt)

#!/usr/bin/env bun
/**
 * cue CLI entrypoint.
 *
 * Pure dispatch: parse the leading flags (--help, --version), pick a
 * subcommand from the registry in commands/_index.ts, and hand the rest of
 * argv to that command's `run(args)`. All real logic lives in command modules.
 *
 * Exit codes:
 *   0  success
 *   1  user error (unknown command, bad args, missing profile)
 *   2  internal error (uncaught exception, missing dep)
 */
import { readFileSync } from "node:fs";
import { fileURLToPath } from "node:url";
import { dirname, resolve } from "node:path";
import { COMMANDS, type CommandName } from "./commands/_index";

const HERE = dirname(fileURLToPath(import.meta.url));
const REPO_ROOT = process.env.CUE_REPO_ROOT ?? process.env.SOUL_REPO_ROOT ?? resolve(HERE, "..");

function readVersion(): string {
  try {
    const pkg = JSON.parse(
      readFileSync(resolve(REPO_ROOT, "package.json"), "utf8"),
    ) as { version?: string };
    return pkg.version ?? "0.0.0";
  } catch {
    return "0.0.0";
  }
}

function printHelp(): void {
  const groups: Record<string, [string, string][]> = {
    "Profile Management": [
      ["list", "List available profiles"],
      ["use", "Activate a profile for the current directory"],
      ["current", "Show the active profile"],
      ["tui", "Three-pane interactive viewer: profiles, skills, preview"],
      ["new", "Scaffold a new profile"],
      ["create-profile", "Create profile from skills/MCPs list"],
      ["icon", "Pick an emoji icon f

### postinstall
echo '' && echo '  ✅ cue installed.' && echo '  Next: run `cue shell install`  (activates the claude/codex shim — required to load profiles)' && echo '        then `cue init`        (pin a profile to this directory)' && echo '  Docs: https://github.com/opencue/cuecards' && echo ''

### prepack
bash scripts/prepack-check.sh && bun run build:bundle