registry / AI-agent control-surface risk / 0xray

0xray

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

This report shows the evidence for 0xray@4.0.28. 16 of 31 known versions are blocked or flagged. The newest version, 4.1.3, is flagged. See all versions.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Automatic postinstall mutates a broad, foreign AI-agent control surface, including machine-home Hermes and OpenClaw paths and Cursor hook reload, without a consent gate. That is install-time agent control hijack even though some machine writes are skipped for isolated homes.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install lifecycle postinstall, with no user confirmation.

Impact

A dependency install silently changes which agent instructions, skills, MCP servers, and tool hooks run for multiple AI products on the machine.

Mechanism

postinstall.cjs resolves the consumer directory and installAllBridges copies plugins, merges agent and MCP config, writes AGENTS.md, installs Cursor hook scripts, and best-effort executes hook installation and a local Cursor reload.

Policy narrative

On npm install, postinstall resolves the consumer project and writes managed AGENTS.md. It then installs four chat bridges plus Cursor hooks: OpenCode config and plugins in the project, Hermes files under the machine ~/.hermes directory, OpenClaw skills under ~/.openclaw, and .cursor/hooks.json. The Cursor path reads /proc command lines for an exec-daemon auth token and calls the local agent reload endpoint. Git hooks are installed by spawning another script. None of this waits for a user command.

AI rationale

Evidence

package.jsonscripts/node/postinstall.cjsscripts/node/install-bridges.cjsAGENTS.mdopencode.json.mcp.json.cursor/hooks.json~/.hermes/plugins/xray-hermes~/.openclaw/skills

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.

Evidence for policy risk

npm postinstall unconditionally runs scripts/node/postinstall.cjs against the consumer project via INIT_CWD.
That hook writes a managed AGENTS.md into the consumer and then calls installAllBridges.
installAllBridges merges OpenCode config, deploys MCP JSON, and installs Hermes, OpenClaw, Grok, and Cursor bridges plus git hooks with no consent prompt.
On a normal home, Hermes plugin files are copied to the machine ~/.hermes plugin directory and OpenClaw skills are synced into ~/.openclaw/skills.
Cursor install rewrites project .cursor/hooks.json and scans /proc for a local exec-daemon auth token to call ReloadAgentSkills.

Evidence against

Dependencies do not include a runtime self-dependency on 0xray.
Machine ~/.grok plugin copy is skipped for a shared home, and Hermes/OpenClaw machine writes are skipped when HOME is isolated or the install root is ephemeral.
The package is an agent-orchestration CLI whose later setup command is separate from this automatic wear.

Behavioral surface

Source

ChildProcessCrypto

Source & flagged code

25 flagged

package.jsonView file

Lines 73-113json

73 "test": "vitest run",

74 "test:batch": "npm test",

75 "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",

76 "test:core-framework": "npm test -- src/__tests__/unit/self-direction-activation.test.ts src/__tests__/unit/ast-code-parser.test.ts src/__tests__/unit/v2-deletion-protection.test.ts",

77 "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",

78 "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

79 "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",

80 "test:code-analysis": "npm test -- src/__tests__/unit/codebase-context-analyzer.test.ts src/__tests__/unit/dependency-graph-builder.test.ts src/__tests__/unit/rule-enforcer.test.ts src/__tests__/unit/codex-parser.test.ts src/__tests__/unit/codex-injector.test.ts",

81 "test:processors": "npm test -- src/__tests__/unit/processor-activation.test.ts src/__tests__/unit/typescript-compilation-processor.test.ts",

82 "test:miscellaneous": "npm test -- src/__tests__/unit/blocked-test.test.ts",

83 "test:grok-bot": "npm test -- src/__tests__/unit/grok-bot-seat-doctor.test.ts src/__tests__/unit/grok-bot-op-proc-map.test.ts src/__tests__/unit/lead-cadence.test.ts src/__tests__/unit/grok-bot-auto-review-policy.test.ts",

84 "test:quick": "npm test -- src/__tests__/integration/boot-orchestrator.integration.test.ts src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts",

85 "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous && npm test -- src/__tests__/unit/llm-governance-provider.test.ts src/__tests__/unit/mcp-server-smoke.test.ts src/__tests__/unit/cursor-hooks.test.ts src/__tests__/unit/host-vs-mill-score.test.ts && npm run test:grok-bot",

86 "test:integration-all": "npm test -- src/__tests__/integration/",

87 "test:performance-all": "npm test -- src/__tests__/performance/ src/__tests__/unit/performance-system.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

88 "test:agents-all": "echo 'Legacy agents test entry retired'",

89 "test:infrastructure": "npm test -- src/__tests__/infrastructure/",

90 "test:root": "npm test -- src/__tests__/integration/server.test.ts src/__tests__/framework-enforcement-integration.test.ts",

91 "test:pipelines": "node src/__tests__/pipeline/run-all-pipelines.mjs",

92 "test:full-suite": "npm run typecheck && npm run test:integration-all && npm run test:performance-all && npm run test:infrastructure && npm run test:root",

93 "postinstall": "node scripts/node/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "setup-dev": "node scripts/node/setup-dev.cjs",

95 "prepare-consumer": "node scripts/node/prepare-consumer.cjs",

96 "typecheck": "tsc --noEmit",

97 "lint": "eslint -c tests/config/eslint.config.js src",

98 "lint:fix": "eslint src --fix",

99 "security-audit": "npm audit || true",

100 "test:security-audit": "npm run test:security",

101 "test:dependency-scan": "npm run security-audit",

102 "test:integration": "node scripts/mjs/test-consumer-readiness.mjs && node scripts/mjs/test-mcp-functionality.mjs",

103 "test:e2e": "node scripts/node/validate-mcp-connectivity.js && node scripts/node/validate-external-processes.js",

104 "live-feedback-session": "npx --yes tsx scripts/live-taskhandler-feedback-session.ts",

105 "validate": "echo \"[xray] Use 'npm test' or 'npm run test:comprehensive'.\"",

106 "validate:quick": "npm run validate",

107 "debug:inference:force": "XRAY_FORCE_MCP_GOVERNANCE=true XRAY_DEV_PATH=dist node dist/cli/index.js inference:run --force",

108 "validate:full": "npm run validate",

109 "test:unified": "node scripts/test/test-unified-framework.mjs",

110 "test:consumer": "node scripts/mjs/test-consumer-readiness.mjs",

111 "config:setup": "node scripts/config/utils.js setup-dev",

112 "monitoring:start": "node scripts/monitoring/daemon.js start",

113 "monitoring:stop": "node scripts/monitoring/daemon.js stop",

dist/security/security-scanner.jsView file

Lines 1-31javascript

1/**

2 * 0xRay Framework - Security Scanner

3 *

4 * Automated security vulnerability scanning and compliance validation

5 * Integrates with security tools and provides comprehensive security reports

6 */

7import { exec } from "child_process";

8import { promises as fs }

dist/core/boot-orchestrator.jsView file

Lines 152-192javascript

152 this.pluginServerRegistry = new PluginServerConfigRegistry();

153 const registered = this.pluginServerRegistry.registerAllPluginServers(this.pluginRegistry, { overwrite: false });

154

scripts/node/postinstall.cjsView file

Lines 21-61javascript

21function structuredLog(component, action, status, details) {

22 const ts = new Date().toISOString();

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

scripts/foundry/mint-suit.cjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rn millplantprotocol.foundryplantdir(millpackageroot); } function emptyplantfiles() { return { skills: [], agents: [] }; } function catalogplant(kind, millpackageroot) { if (!kind || kind === "mill") { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const parsed = millplantprotocol.parseplanttoken(kind); if (!parsed || parsed.builtin) { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const pkgroot = millplantprotocol.resolvepackageroot(parsed.packagename, { targetdir: millpack

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/foundry/mint-suit.cjsView on unpkg

dist/integrations/grok/grok-cli.jsView file

Lines 1-29javascript

1/**

2 * Grok CLI Integration for 0xRay

3 *

4 * This module provides the integration points for using 0xRay with the official Grok CLI.

5 *

6 * Primary mechanism: MCP (Model Context Protocol)

7 * Grok CLI can consume MCP servers. By registering the 0xRay MCP servers,

8 * users get access to Governance, skills, and other capabilities directly inside Grok conversations.

9 *

10 * Recommended registration (via npx or Grok's tooling):

dist/integrations/cursor/hooks/pre-compact.shView file

•path = [redacted]-compact.sh kind = build_helper sizeBytes = 130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/cursor/hooks/pre-compact.shView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 8140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 44752 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/cli/index.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg

dist/cli/server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/cli/server.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/server.jsView on unpkg

dist/cli/commands/mcp-install.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/cli/commands/mcp-install.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/mcp-install.jsView on unpkg

dist/cli/commands/skill-install.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/cli/commands/sk[redacted] matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/skill-install.jsView on unpkg

dist/integrations/hooks/pipeline-hook-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = [redacted]-hook-runtime.mjs matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/hooks/pipeline-hook-runtime.mjsView on unpkg

dist/cli/commands/govern.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/cli/commands/govern.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/govern.jsView on unpkg

dist/execution/opencode-cli-invoker.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/execution/opencode-cli-invoker.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/execution/opencode-cli-invoker.jsView on unpkg

dist/integrations/plugins/plugin-integration.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = [redacted]-integration.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/plugins/plugin-integration.jsView on unpkg

dist/mcps/boot-orchestrator.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/mcps/boot-orchestrator.server.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/boot-orchestrator.server.jsView on unpkg

dist/mcps/security-scan.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/mcps/security-scan.server.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/security-scan.server.jsView on unpkg

dist/delegation/codebase-context-analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.27 matchedPath = dist/delegation/codebase-context-analyzer.js matchedIdentity = npm:MHhyYXk:4.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/delegation/codebase-context-analyzer.jsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/node/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/node/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/security/security-scanner.jsView file

6*/ L7: import { exec } from "child_process"; L8: import { promises as fs } from "fs";

High

Child Process

Package source references child process execution.

dist/security/security-scanner.jsView on unpkg · L6

Findings

2 Critical20 High6 Medium5 Low

CriticalAi Agent Control Hijackscripts/node/postinstall.cjs

CriticalTrigger Reachable Excluded Directory Payloaddist/cli/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/security/security-scanner.js

HighShelldist/security/security-scanner.js

HighExternal Ai Agent Control Surface Mutationdist/scripts/pre-command.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/foundry/mint-suit.cjs

HighRuntime Package Installdist/integrations/grok/grok-cli.js

HighPayload In Excluded Dir.opencode/init.sh

HighSemantic Analysis Limiteddist/core/framework-logger.js

Affected versions and remediation

This report applies to 0xray@4.0.28.

The versions list below shows the verdict for each recorded version.

Avoid installing 0xray@4.0.28. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-27 20:00:30.109Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

31 known versions

4.1.3latestSuspiciousAI-agent capability abuseWarnPublishedOct 19, 2026, 8:02 PM 4.1.2SuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 10:51 AM 4.1.1SuspiciousAI-agent capability abuseWarnPublishedOct 18, 2026, 10:05 PM 4.1.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 15, 2026, 3:33 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code