Loading npm security reports…

0xray@4.0.1: AI-agent control-surface risk | LPM Firewall

registry / 0xray / 4.0.1

0xray@4.0.1

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically alters consumer-project and host AI-agent control surfaces. It installs and enables hooks and plugins that run package code during future agent and Git actions.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, which invokes postinstall.

Impact

The package gains persistent control over AI-agent tool gating and repository commit hooks without an explicit setup command.

Mechanism

Automatic installation of agent configurations, plugins, hooks, and command registrations.

Policy narrative

A normal npm install invokes postinstall. That script deploys project configuration, copies and registers plugins in host-level AI-agent directories, enables an OpenClaw pre-tool plugin, and installs Git hooks. These changes cause package-controlled code to run in later agent and commit workflows without a separate user setup action.

Rationale

The automatic lifecycle hook broadly mutates foreign project and host AI-agent control surfaces, including enabling a host-level tool hook. This meets the install-hook abuse blocking policy even though no direct secret exfiltration was found.

Evidence

package.jsonscripts/node/postinstall.cjsscripts/node/install-bridges.cjsscripts/node/bridge-mcp-wiring.cjsscripts/hooks/install-hooks.cjsAGENTS.md.gitignore.mcp.jsonopencode.json.grok/plugins/0xray~/.grok/plugins/0xray

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/node/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/node/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/security/comprehensive-security-audit.jsView file

61{ L62: pattern: /child_process\.exec\s*\(/g, L63: severity: "critical",

High

Child Process

Package source references child process execution.

dist/security/comprehensive-security-audit.jsView on unpkg · L61

36owasp: "A03:2021-Injection", L37: title: "Code Injection via eval()", L38: impact: "Arbitrary code execution possible",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security/comprehensive-security-audit.jsView on unpkg · L36

dist/security/security-scanner.jsView file

11import { promptSecurityValidator, } from "./prompt-security-validator.js"; L12: const execAsync = promisify(exec); L13: export class SecurityScanner {

High

Shell

Package source references shell execution.

dist/security/security-scanner.jsView on unpkg · L11

dist/core/boot-orchestrator.jsView file

172try { L173: orchestratorModule = await import("../core/orchestrator"); L174: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/boot-orchestrator.jsView on unpkg · L172

scripts/node/postinstall.cjsView file

20Install-time code directly mutates a foreign AI-agent control surface: L20: function deployManagedAgents(packageRoot, targetDir, log) { L21: const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md"); L22: const agentsDest = path.join(targetDir, "AGENTS.md"); L23: if (!fs.existsSync(agentsConsumer)) return; ... L31: } L32: fs.writeFileSync(agentsDest, content); L33: } else { L34: log("postinstall", "Skipped AGENTS.md (consumer-customized)", "info"); L35: } Write operation from scripts/node/postinstall.cjs: L20: function deployManagedAgents(packageRoot, targetDir, log) { L21: const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md"); L22: const agentsDest = path.join(targetDir, "AGENTS.md"); L23: if (!fs.existsSync(agentsConsumer)) return; ... L31: } L32: fs.writeFileSync

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/node/postinstall.cjsView on unpkg · L20

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

scripts/node/install-bridges.cjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. .existssync(hooksdir)) fs.mkdirsync(hooksdir, { recursive: true }); if (!fs.existssync(hookspath)) return; } try { const hooks = json.parse(fs.readfilesync(hookspath, "utf8")); if (!fs.existssync(hookscript)) return; patchgrokhookentry(hooks.hooks?.pretooluse?.[0]?.hooks?.[0], packageroot, targetdir, "pre-tool-use.js"); patchgrokhookentry(hooks.hooks?.sessionstart?.[0]?.hooks?.[0], packageroot, targetdir, "session-start.js"); patchgrokhookentry( hooks.hooks?.userpromptsubmit?.[0]?.hooks?.[0], packageroot, targetdir, "session-start.js", "--hook-event=user_prompt_submit", ); patchgrokhookentry(hooks.hooks?.posttool

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/node/install-bridges.cjsView on unpkg

dist/integrations/grok/grok-cli.jsView file

9* L10: * Recommended registration (via npx or Grok's tooling): L11: * npx 0xray grok install ... L19: import path from 'path'; L20: import { execSync } from 'child_process'; L21: import { createRequire } from 'module';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/integrations/grok/grok-cli.jsView on unpkg · L9

dist/integrations/hermes-agent/conftest.pyView file

•path = dist/integrations/hermes-agent/conftest.py kind = build_helper sizeBytes = 409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/hermes-agent/conftest.pyView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 7583 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 43757 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg