registry / AI-agent capability abuse / 0xray / 4.0.30

0xray@4.0.30

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

AI Security Review

scanned 24d ago · by lpm-firewall-ai

The package has a concrete first-party agent-extension capability that automatically grants trust after an explicit installation command. This warrants a non-blocking warning under the agent integration policy, but the inspected source does not support a malware finding.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs the Grok install command.

Impact

The plugin gains trusted agent-extension status in the user-selected Grok environment; this is a guarded capability risk rather than evidence of an active attack.

Mechanism

The command installs the 0xray plugin and invokes the Grok CLI trust operation for it.

AI rationale

Evidence

dist/cli/commands/grok-install.jsdist/integrations/grok/grok-cli.js.grok/plugins/0xray

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script, but that script links a vendored component and asks the user to run a separate wear command.
The Grok integration is exposed as an explicit install command and describes installing hooks and MCP servers.
That user-invoked integration automatically marks the installed 0xray Grok plugin as trusted.

Evidence against

No credential collection, exfiltration, remote payload loading, or destructive action was identified in the inspected activation paths.
The postinstall path inspected does not install the Grok plugin or trust it.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 632 file(s), 5.92 MB of source, external domains: 0xray.ai, 127.0.0.1, api.example.com, api.github.com, auth.x.ai, codeload.github.com, example.com, github.com, img.shields.io, mcp-production-80e2.up.railway.app, opencode.ai, registry.npmjs.org, schema.getpostman.com, schema.org, www.google.com, www.sitemaps.org, www.typescriptlang.org, your-governance-endpoint.com

Source & flagged code

25 flagged

package.jsonView file

Lines 73-113json

73 "test": "vitest run",

74 "test:batch": "npm test",

75 "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",

76 "test:core-framework": "npm test -- src/__tests__/unit/self-direction-activation.test.ts src/__tests__/unit/ast-code-parser.test.ts src/__tests__/unit/v2-deletion-protection.test.ts",

77 "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",

78 "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

79 "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",

80 "test:code-analysis": "npm test -- src/__tests__/unit/codebase-context-analyzer.test.ts src/__tests__/unit/dependency-graph-builder.test.ts src/__tests__/unit/rule-enforcer.test.ts src/__tests__/unit/codex-parser.test.ts src/__tests__/unit/codex-injector.test.ts",

81 "test:processors": "npm test -- src/__tests__/unit/processor-activation.test.ts src/__tests__/unit/typescript-compilation-processor.test.ts",

82 "test:miscellaneous": "npm test -- src/__tests__/unit/blocked-test.test.ts",

83 "test:grok-bot": "npm test -- src/__tests__/unit/grok-bot-seat-doctor.test.ts src/__tests__/unit/grok-bot-op-proc-map.test.ts src/__tests__/unit/lead-cadence.test.ts src/__tests__/unit/grok-bot-auto-review-policy.test.ts",

84 "test:quick": "npm test -- src/__tests__/integration/boot-orchestrator.integration.test.ts src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts",

85 "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous && npm test -- src/__tests__/unit/llm-governance-provider.test.ts src/__tests__/unit/mcp-server-smoke.test.ts src/__tests__/unit/cursor-hooks.test.ts src/__tests__/unit/host-vs-mill-score.test.ts src/__tests__/unit/wear-pack-file-list.test.ts && npm run test:grok-bot",

86 "test:integration-all": "npm test -- src/__tests__/integration/",

87 "test:performance-all": "npm test -- src/__tests__/performance/ src/__tests__/unit/performance-system.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

88 "test:agents-all": "echo 'Legacy agents test entry retired'",

89 "test:infrastructure": "npm test -- src/__tests__/infrastructure/",

90 "test:root": "npm test -- src/__tests__/integration/server.test.ts src/__tests__/framework-enforcement-integration.test.ts",

91 "test:pipelines": "node src/__tests__/pipeline/run-all-pipelines.mjs",

92 "test:full-suite": "npm run typecheck && npm run test:integration-all && npm run test:performance-all && npm run test:infrastructure && npm run test:root",

93 "postinstall": "node scripts/node/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "setup-dev": "node scripts/node/setup-dev.cjs",

95 "prepare-consumer": "node scripts/node/prepare-consumer.cjs",

96 "typecheck": "tsc --noEmit",

97 "lint": "eslint -c tests/config/eslint.config.js src",

98 "lint:fix": "eslint src --fix",

99 "security-audit": "npm audit || true",

100 "test:security-audit": "npm run test:security",

101 "test:dependency-scan": "npm run security-audit",

102 "test:integration": "node scripts/mjs/test-consumer-readiness.mjs && node scripts/mjs/test-mcp-functionality.mjs",

103 "test:e2e": "node scripts/node/validate-mcp-connectivity.js && node scripts/node/validate-external-processes.js",

104 "live-feedback-session": "npx --yes tsx scripts/live-taskhandler-feedback-session.ts",

105 "validate": "echo \"[xray] Use 'npm test' or 'npm run test:comprehensive'.\"",

106 "validate:quick": "npm run validate",

107 "debug:inference:force": "XRAY_FORCE_MCP_GOVERNANCE=true XRAY_DEV_PATH=dist node dist/cli/index.js inference:run --force",

108 "validate:full": "npm run validate",

109 "test:unified": "node scripts/test/test-unified-framework.mjs",

110 "test:consumer": "node scripts/mjs/test-consumer-readiness.mjs",

111 "config:setup": "node scripts/config/utils.js setup-dev",

112 "monitoring:start": "node scripts/monitoring/daemon.js start",

113 "monitoring:stop": "node scripts/monitoring/daemon.js stop",

dist/security/security-scanner.jsView file

Lines 1-31javascript

1/**

2 * 0xRay Framework - Security Scanner

3 *

4 * Automated security vulnerability scanning and compliance validation

5 * Integrates with security tools and provides comprehensive security reports

6 */

7import { exec } from "child_process";

8import { promises as fs }

dist/core/boot-orchestrator.jsView file

Lines 152-192javascript

152 this.pluginServerRegistry = new PluginServerConfigRegistry();

153 const registered = this.pluginServerRegistry.registerAllPluginServers(this.pluginRegistry, { overwrite: false });

154

scripts/node/postinstall.cjsView file

Lines 11-51javascript

11 listConsumerSkillNames,

12 listConsumerAgentFiles,

13 loadFoundryParams,

14 readPackageIdentity,

15} = require("../foundry/mint-suit.cjs");

17const XRAY_MANAGED_AGENTS_MARKER = "";

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

scripts/foundry/mint-suit.cjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rn millplantprotocol.foundryplantdir(millpackageroot); } function emptyplantfiles() { return { skills: [], agents: [] }; } function catalogplant(kind, millpackageroot) { if (!kind || kind === "mill") { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const parsed = millplantprotocol.parseplanttoken(kind); if (!parsed || parsed.builtin) { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const pkgroot = millplantprotocol.resolvepackageroot(parsed.packagename, { targetdir: millpack

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/foundry/mint-suit.cjsView on unpkg

dist/integrations/grok/grok-cli.jsView file

Lines 1-29javascript

1/**

2 * Grok CLI Integration for 0xRay

3 *

4 * This module provides the integration points for using 0xRay with the official Grok CLI.

5 *

6 * Primary mechanism: MCP (Model Context Protocol)

7 * Grok CLI can consume MCP servers. By registering the 0xRay MCP servers,

8 * users get access to Governance, skills, and other capabilities directly inside Grok conversations.

9 *

10 * Recommended registration (via npx or Grok's tooling):

dist/integrations/cursor/hooks/pre-compact.shView file

•path = [redacted]-compact.sh kind = build_helper sizeBytes = 130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/cursor/hooks/pre-compact.shView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 8140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 43962 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg

dist/cli/server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/cli/server.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High