registry / 0xray / 4.0.3

0xray@4.0.3

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically alters consumer and machine-wide AI-agent control surfaces. It registers MCP servers and installs a pre-tool hook without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation of the package in a consumer project

Impact

The package can cause future AI-agent sessions to execute its MCP commands and hook runtime.

Mechanism

Postinstall bridge deployment and AI-agent configuration mutation

Policy narrative

On npm install, the postinstall script identifies the consumer project and launches a four-platform bridge installer. That installer modifies project AI configuration and installs integrations for OpenCode, Grok, Hermes, and OpenClaw. The OpenClaw path writes a Node pre-tool hook and hook manifest under the user's home directory, making the package runtime part of later agent tool decisions. This is an unconsented, broad AI-agent control-surface mutation during installation.

Rationale

The automatic postinstall changes both consumer-project and home-directory AI-agent configuration, including enabled MCP commands and a pre-tool hook. This meets the install-hook abuse boundary despite no confirmed secret theft or remote payload execution.

Evidence

package.jsonscripts/node/postinstall.cjsscripts/node/install-bridges.cjsscripts/node/bridge-mcp-wiring.cjsopencode.json.mcp.json.xray/~/.openclaw/hooks/xray-pre-tool.mjs~/.openclaw/hooks/xray-pre-tool.json~/.hermes/config.yaml~/.grok/plugins/0xray

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs the consumer installer.
That installer deploys four AI-platform bridges into the consuming project.
It merges enabled local MCP commands into the consumer OpenCode configuration.
It installs and enables an OpenClaw pre-tool hook in the user's home configuration.

Evidence against

No credential harvesting or network exfiltration was found in the inspected install path.
The installed hook is a package-owned tool gate rather than an opaque payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 598 file(s), 5.61 MB of source, external domains: 0xray.ai, 127.0.0.1, api.example.com, api.github.com, auth.x.ai, codeload.github.com, example.com, github.com, img.shields.io, opencode.ai, registry.npmjs.org, schema.getpostman.com, schema.org, www.sitemaps.org, www.typescriptlang.org, your-governance-endpoint.com

Source & flagged code

26 flagged

package.jsonView file

Lines 70-110json

70 "clean": "rm -rf dist tsconfig.tsbuildinfo tsconfig.*.tsbuildinfo",

71 "test": "vitest run",

72 "test:batch": "npm test",

73 "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",

74 "test:core-framework": "npm test -- src/__tests__/unit/self-direction-activation.test.ts src/__tests__/unit/ast-code-parser.test.ts src/__tests__/unit/v2-deletion-protection.test.ts",

75 "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",

76 "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

77 "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",

78 "test:code-analysis": "npm test -- src/__tests__/unit/codebase-context-analyzer.test.ts src/__tests__/unit/dependency-graph-builder.test.ts src/__tests__/unit/rule-enforcer.test.ts src/__tests__/unit/codex-parser.test.ts src/__tests__/unit/codex-injector.test.ts",

79 "test:processors": "npm test -- src/__tests__/unit/processor-activation.test.ts src/__tests__/unit/typescript-compilation-processor.test.ts",

80 "test:miscellaneous": "npm test -- src/__tests__/unit/blocked-test.test.ts",

81 "test:quick": "npm test -- src/__tests__/integration/boot-orchestrator.integration.test.ts src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts",

82 "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous",

83 "test:integration-all": "npm test -- src/__tests__/integration/",

84 "test:performance-all": "npm test -- src/__tests__/performance/ src/__tests__/unit/performance-system.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

85 "test:agents-all": "echo 'Legacy agents test entry retired'",

86 "test:infrastructure": "npm test -- src/__tests__/infrastructure/",

87 "test:root": "npm test -- src/__tests__/integration/server.test.ts src/__tests__/framework-enforcement-integration.test.ts",

88 "test:pipelines": "node src/__tests__/pipeline/run-all-pipelines.mjs",

89 "test:full-suite": "npm run typecheck && npm run test:integration-all && npm run test:performance-all && npm run test:infrastructure && npm run test:root",

90 "postinstall": "node scripts/node/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L90

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L90

91 "setup-dev": "node scripts/node/setup-dev.cjs",

92 "prepare-consumer": "node scripts/node/prepare-consumer.cjs",

93 "typecheck": "tsc --noEmit",

94 "lint": "eslint -c tests/config/eslint.config.js src",

95 "lint:fix": "eslint src --fix",

96 "security-audit": "npm audit || true",

97 "test:security-audit": "npm run test:security",

98 "test:dependency-scan": "npm run security-audit",

99 "test:integration": "node scripts/mjs/test-consumer-readiness.mjs && node scripts/mjs/test-mcp-functionality.mjs",

100 "test:e2e": "node scripts/node/validate-mcp-connectivity.js && node scripts/node/validate-external-processes.js",

101 "live-feedback-session": "npx --yes tsx scripts/live-taskhandler-feedback-session.ts",

102 "validate": "echo \"[xray] Use 'npm test' or 'npm run test:comprehensive'.\"",

103 "validate:quick": "npm run validate",

104 "debug:inference:force": "XRAY_FORCE_MCP_GOVERNANCE=true XRAY_DEV_PATH=dist node dist/cli/index.js inference:run --force",

105 "validate:full": "npm run validate",

106 "test:unified": "node scripts/test/test-unified-framework.mjs",

107 "test:consumer": "node scripts/test/test-consumer-readiness.cjs",

108 "config:setup": "node scripts/config/utils.js setup-dev",

109 "monitoring:start": "node scripts/monitoring/daemon.js start",

110 "monitoring:stop": "node scripts/monitoring/daemon.js stop",

dist/security/comprehensive-security-audit.jsView file

Lines 16-81javascript

16 agentVotes = new Map();

17 severityWeights = {

18 critical: 20,

19 high: 10,

20 medium: 5,

21 low: 2,

22 info: 0,

23 };

24 defaultAgentWeights = {

25 "security-auditor": 0.35,

26 "code-analyzer": 0.30,

27 "testing-lead": 0.20,

28 "architect": 0.15,

29 };

30 dangerousPatterns = [

31 {

32 pattern: /eval\s*\(/g,

33 severity: "critical",

34 category: "injection",

35 cwe: "CWE-95",

36 owasp: "A03:2021-Injection",

37 title: "Code Injection via eval()",

38 impact: "Arbitrary code execution possible",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security/comprehensive-security-audit.jsView on unpkg · L36

39 recommendation: "Avoid eval(). Use safer alternatives like JSON.parse() for data",

40 autoRemediation: {

41 action: "Replace eval() with safe alternative",

42 automated: false,

43 estimatedEffort: "medium",

44 },

45 },

46 {

47 pattern: /Function\s*\(/g,

48 severity: "critical",

49 category: "injection",

50 cwe: "CWE-95",

51 owasp: "A03:2021-Injection",

52 title: "Dynamic Function Creation",

53 impact: "Arbitrary code execution possible",

54 recommendation: "Use direct function calls instead of dynamic construction",

55 autoRemediation: {

56 action: "Replace Function() with named function",

57 automated: false,

58 estimatedEffort: "medium",

59 },

60 },

61 {

62 pattern: /child_process\.exec\s*\(/g,

63 severity: "critical",

High

Child Process

Package source references child process execution.

dist/security/comprehensive-security-audit.jsView on unpkg · L61

64 category: "injection",

65 cwe: "CWE-78",

66 owasp: "A03:2021-Injection",

67 title: "Command Injection via exec()",

68 impact: "OS command injection possible",

69 recommendation: "Use execFile() with validated arguments or avoid shell commands",

70 autoRemediation: {

71 action: "Replace exec() with execFile()",

72 automated: false,

73 estimatedEffort: "low",

74 },

75 },

76 {

77 pattern: /child_process\.spawn\s*\(/g,

78 severity: "high",

79 category: "injection",

80 cwe: "CWE-78",

81 owasp: "A03:2021-Injection",

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/security/comprehensive-security-audit.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/security/comprehensive-security-audit.jsView on unpkg

dist/security/security-scanner.jsView file

Lines 1-31javascript

1/**

2 * 0xRay Framework - Security Scanner

3 *

4 * Automated security vulnerability scanning and compliance validation

5 * Integrates with security tools and provides comprehensive security reports

6 */

7import { exec } from "child_process";

8import { promises as fs } from "fs";

9import { frameworkLogger } from "../core/framework-logger.js";

10import { promisify } from "util";

11import { promptSecurityValidator, } from "./prompt-security-validator.js";

12const execAsync = promisify(exec);

13export class SecurityScanner {

High

Shell

Package source references shell execution.

dist/security/security-scanner.jsView on unpkg · L11

14 config;

15 constructor(config = {}) {

16 this.config = {

17 enabled: true,

18 tools: {

19 npmAudit: true,

20 trivy: false, // Requires separate installation

21 eslintSecurity: true,

22 dependencyCheck: false, // Requires separate installation

23 ...config.tools,

24 },

25 severityThreshold: "moderate",

26 reportPath: "./security-report.json",

27 failOnVulnerabilities: true,

28 ...config,

29 };

30 }

31 /**

dist/core/boot-orchestrator.jsView file

Lines 152-192javascript

152 this.pluginServerRegistry = new PluginServerConfigRegistry();

153 const registered = this.pluginServerRegistry.registerAllPluginServers(this.pluginRegistry, { overwrite: false });

154 this.stateManager.set("plugin:registry", this.pluginRegistry);

155 this.stateManager.set("plugin:serverRegistry", this.pluginServerRegistry);

156 this.stateManager.set("plugin:registered", registered);

157 frameworkLogger.log("boot-orchestrator", "plugin system initialized", "success", { jobId, pluginsDir, registeredServers: registered });

158 return true;

159 }

160 catch (error) {

161 frameworkLogger.log("boot-orchestrator", "plugin-system-init-failed", "error", { jobId, error: error instanceof Error ? error.message : String(error) });

162 return false;

163 }

164 }

165 /**

166 * Load orchestrator as the first component

167 */

168 async loadOrchestrator() {

169 try {

170 // Import orchestrator dynamically to ensure it's loaded first

171 let orchestratorModule;

172 try {

173 orchestratorModule = await import("../core/orchestrator");

174 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/boot-orchestrator.jsView on unpkg · L172

175 catch (importError) {

176 frameworkLogger.log("boot-orchestrator", "orchestrator-load-failed", "error", {

177 error: importError,

178 message: "Failed to load orchestrator",

179 });

180 return false;

181 }

182 const orchestratorInstance = orchestratorModule.xrayOrchestrator;

183 if (!orchestratorInstance) {

184 frameworkLogger.log("boot-orchestrator", "orchestrator-not-found", "error", { message: "Orchestrator instance not found in module" });

185 return false;

186 }

187 // Store in state manager for later access

188 this.stateManager.set("orchestrator", orchestratorInstance);

189 return true;

190 }

191 catch (error) {

192 frameworkLogger.log("boot-orchestrator", "orchestrator-load-failed-outer", "error", { error, message: "Failed to load orchestrator" });

scripts/node/postinstall.cjsView file

Lines 19-59javascript

19} = require("../foundry/mint-suit.cjs");

21function structuredLog(component, action, status, details) {

22 const ts = new Date().toISOString();

23 const detailsPart = details ? ` | ${JSON.stringify(details)}` : "";

24 console.log(`${ts} [${component}] ${action} - ${String(status).toUpperCase()}${detailsPart}`);

25}

27const XRAY_MANAGED_AGENTS_MARKER = "";

29function fillConsumerPlaceholders(content, consumer) {

30 const name = consumer.name || "this project";

31 const versionParen = consumer.version ? ` (${consumer.version})` : "";

32 return content

33 .split("{{CONSUMER_NAME}}")

34 .join(name)

35 .split("{{CONSUMER_VERSION_PAREN}}")

36 .join(versionParen);

37}

39function deployManagedAgents(packageRoot, targetDir, log) {

40 const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md");

41 const agentsDest = path.join(targetDir, "AGENTS.md");

42 if (!fs.existsSync(agentsConsumer)) return;

43 const shouldDeployAgents =

44 !fs.existsSync(agentsDest) ||

45 fs.readFileSync(agentsDest, "utf8").includes(XRAY_MANAGED_AGENTS_MARKER);

46 if (shouldDeployAgents) {

47 let content = fs.readFileSync(agentsConsumer, "utf8");

48 const consumer = readPackageIdentity(path.join(targetDir, "package.json"));

49 content = fillConsumerPlaceholders(content, consumer);

50 if (!content.includes(XRAY_MANAGED_AGENTS_MARKER)) {

51 content = `${content.trimEnd()}\n\n${XRAY_MANAGED_AGENTS_MARKER}\n`;

52 }

53 fs.writeFileSync(agentsDest, content);

54 } else {

55 log("postinstall", "Skipped AGENTS.md (consumer-customized)", "info");

56 }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/node/postinstall.cjsView on unpkg · L39

57}

59function deployConsumerGitignore(packageRoot, targetDir, log) {

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/scripts/pre-command.mjs matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/pre-command.mjsView on unpkg

scripts/node/install-bridges.cjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ost-tool-use.js"); ensuregrokhookevent(hooks, "precompact"); ensuregrokhookevent(hooks, "postcompact"); patchgrokhookentry( hooks.hooks?.precompact?.[0]?.hooks?.[0], packageroot, targetdir, "session-start.js", "--hook-event=pre_compact", ); patchgrokhookentry( hooks.hooks?.postcompact?.[0]?.hooks?.[0], packageroot, targetdir, "session-start.js", "--hook-event=post_compact", ); fs.writefilesync(hookspath, json.stringify(hooks, null, 2) + "\n"); writegrokdiscoveredhooks(targetdir, hookspath, log, label); log(label, "hooks.json patched → grok command-string enforcement gate", "info");

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/node/install-bridges.cjsView on unpkg

dist/integrations/grok/grok-cli.jsView file

Lines 1-29javascript

1/**

2 * Grok CLI Integration for 0xRay

3 *

4 * This module provides the integration points for using 0xRay with the official Grok CLI.

5 *

6 * Primary mechanism: MCP (Model Context Protocol)

7 * Grok CLI can consume MCP servers. By registering the 0xRay MCP servers,

8 * users get access to Governance, skills, and other capabilities directly inside Grok conversations.

9 *

10 * Recommended registration (via npx or Grok's tooling):

11 * npx 0xray grok install

12 *

13 * This will help configure the user's Grok CLI to include the following MCP servers:

14 * - governance (Dynamo Solar SSOT + real skill deliberation)

15 * - All knowledge-skill MCP servers (code-review, security-audit, researcher, etc.)

16 */

17import { frameworkLogger } from '../../core/framework-logger.js';

18import fs from 'fs';

19import path from 'path';

20import { execSync } from 'child_process';

21import { createRequire } from 'module';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/integrations/grok/grok-cli.jsView on unpkg · L9

22import { syncBuiltinSkills } from '../../cli/commands/skill-install.js';

23import { mintAfterWear } from '../../cli/commands/foundry-mint-wear.js';

24// ESM-compatible __dirname (this file is compiled to ESM)

25const __dirname = path.dirname(new URL(import.meta.url).pathname);

26const packageRoot = path.resolve(__dirname, '..', '..', '..');

27const requireCjs = createRequire(import.meta.url);

28const { resolveConsumerTargetDir, patchGrokHooks } = requireCjs(path.join(packageRoot, 'scripts/node/install-bridges.cjs'));

29const { XRAY_MCP_SERVERS, resolveRepertoireMcp } = requireCjs(path.join(packageRoot, 'scripts/node/bridge-mcp-wiring.cjs'));

dist/integrations/hermes-agent/conftest.pyView file

•path = dist/integrations/hermes-agent/conftest.py kind = build_helper sizeBytes = 409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/hermes-agent/conftest.pyView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 7583 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 43757 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/cli/index.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg

dist/cli/server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/cli/server.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/server.jsView on unpkg

scripts/node/bridge-mcp-wiring.cjsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = scripts/node/bridge-mcp-wiring.cjs matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/node/bridge-mcp-wiring.cjsView on unpkg

dist/cli/commands/mcp-install.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/cli/commands/mcp-install.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/mcp-install.jsView on unpkg

dist/integrations/hooks/pipeline-hook-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = [redacted]-hook-runtime.mjs matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/hooks/pipeline-hook-runtime.mjsView on unpkg

dist/cli/commands/govern.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/cli/commands/govern.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/govern.jsView on unpkg

dist/execution/opencode-cli-invoker.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/execution/opencode-cli-invoker.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/execution/opencode-cli-invoker.jsView on unpkg

dist/integrations/plugins/plugin-integration.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = [redacted]-integration.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/plugins/plugin-integration.jsView on unpkg

dist/mcps/boot-orchestrator.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/mcps/boot-orchestrator.server.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/boot-orchestrator.server.jsView on unpkg

dist/mcps/security-scan.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.1 matchedPath = dist/mcps/security-scan.server.js matchedIdentity = npm:MHhyYXk:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/security-scan.server.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/node/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/node/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/security/comprehensive-security-audit.jsView file

61{ L62: pattern: /child_process\.exec\s*\(/g, L63: severity: "critical",

High

Child Process

Package source references child process execution.

dist/security/comprehensive-security-audit.jsView on unpkg · L61

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/security/comprehensive-security-audit.jsView on unpkg

36owasp: "A03:2021-Injection", L37: title: "Code Injection via eval()", L38: impact: "Arbitrary code execution possible",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security/comprehensive-security-audit.jsView on unpkg · L36

dist/security/security-scanner.jsView file

11import { promptSecurityValidator, } from "./prompt-security-validator.js"; L12: const execAsync = promisify(exec); L13: export class SecurityScanner {

High

Shell

Package source references shell execution.

dist/security/security-scanner.jsView on unpkg · L11

dist/core/boot-orchestrator.jsView file

172try { L173: orchestratorModule = await import("../core/orchestrator"); L174: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/boot-orchestrator.jsView on unpkg · L172

scripts/node/postinstall.cjsView file

39Install-time code directly mutates a foreign AI-agent control surface: L39: function deployManagedAgents(packageRoot, targetDir, log) { L40: const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md"); L41: const agentsDest = path.join(targetDir, "AGENTS.md"); L42: if (!fs.existsSync(agentsConsumer)) return; ... L52: } L53: fs.writeFileSync(agentsDest, content); L54: } else { L55: log("postinstall", "Skipped AGENTS.md (consumer-customized)", "info"); L56: } Write operation from scripts/node/postinstall.cjs: L39: function deployManagedAgents(packageRoot, targetDir, log) { L40: const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md"); L41: const agentsDest = path.join(targetDir, "AGENTS.md"); L42: if (!fs.existsSync(agentsConsumer)) return; ... L52: } L53: fs.writeFileSync

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/node/postinstall.cjsView on unpkg · L39

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/pre-command.mjsView on unpkg

scripts/node/install-bridges.cjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/node/install-bridges.cjsView on unpkg

dist/integrations/grok/grok-cli.jsView file

9* L10: * Recommended registration (via npx or Grok's tooling): L11: * npx 0xray grok install ... L19: import path from 'path'; L20: import { execSync } from 'child_process'; L21: import { createRequire } from 'module';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/integrations/grok/grok-cli.jsView on unpkg · L9

dist/integrations/hermes-agent/conftest.pyView file

•path = dist/integrations/hermes-agent/conftest.py kind = build_helper sizeBytes = 409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/hermes-agent/conftest.pyView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 7583 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 43757 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg

dist/cli/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/server.jsView on unpkg

scripts/node/bridge-mcp-wiring.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/node/bridge-mcp-wiring.cjsView on unpkg

dist/cli/commands/mcp-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/mcp-install.jsView on unpkg

dist/integrations/hooks/pipeline-hook-runtime.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/hooks/pipeline-hook-runtime.mjsView on unpkg

dist/cli/commands/govern.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/govern.jsView on unpkg

dist/execution/opencode-cli-invoker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/execution/opencode-cli-invoker.jsView on unpkg

dist/integrations/plugins/plugin-integration.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/plugins/plugin-integration.jsView on unpkg

dist/mcps/boot-orchestrator.server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/boot-orchestrator.server.jsView on unpkg

dist/mcps/security-scan.server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/security-scan.server.jsView on unpkg

Findings

2 Critical20 High6 Medium6 Low

CriticalAi Agent Control Hijackscripts/node/postinstall.cjs

CriticalTrigger Reachable Excluded Directory Payloaddist/cli/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/security/comprehensive-security-audit.js

HighShelldist/security/security-scanner.js

HighExternal Ai Agent Control Surface Mutationdist/scripts/pre-command.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/node/install-bridges.cjs

HighRuntime Package Installdist/integrations/grok/grok-cli.js

HighPayload In Excluded Dir.opencode/init.sh

HighSemantic Analysis Limiteddist/core/framework-logger.js

HighKnown Malware Source Similaritydist/cli/server.js

HighKnown Malware Source Similarityscripts/node/bridge-mcp-wiring.cjs

HighKnown Malware Source Similaritydist/cli/commands/mcp-install.js

HighKnown Malware Source Similaritydist/cli/index.js

HighKnown Malware Source Similaritydist/integrations/hooks/pipeline-hook-runtime.mjs

HighKnown Malware Source Similaritydist/security/comprehensive-security-audit.js

HighKnown Malware Source Similaritydist/cli/commands/govern.js

HighKnown Malware Source Similaritydist/execution/opencode-cli-invoker.js

HighKnown Malware Source Similaritydist/integrations/plugins/plugin-integration.js

HighKnown Malware Source Similaritydist/mcps/boot-orchestrator.server.js

HighKnown Malware Source Similaritydist/mcps/security-scan.server.js

HighKnown Malware Source Similaritydist/scripts/pre-command.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/core/boot-orchestrator.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/integrations/hermes-agent/conftest.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/security/comprehensive-security-audit.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings