registry / AI-agent capability abuse / 0xray / 4.0.32

0xray@4.0.32

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The inspected source supports a warning for explicit user-command mutation of an agent instruction surface under the supplied policy. It does not support blocking as malware or unconsented install-hook control hijacking.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs skill:install with a source argument.

Impact

Installed third-party instructions can influence subsequent agent behavior.

Mechanism

The command resolves and downloads the selected repository, then copies skill instructions into the project's agent skill directory.

AI rationale

Evidence

dist/cli/index.jsdist/cli/commands/skill-install.js.opencode/skills

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit skill:install CLI action invokes the community skill installer.
The installer selects a registry URL or caller-supplied source and downloads it.
Downloaded skill instructions are copied into the project's .opencode/skills directory.
The active postinstall function links vendored Repertoire rather than invoking the skill installer.

Evidence against

Skill installation requires an explicit user command; the inspected flow does not establish covert installation or malicious intent.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 636 file(s), 5.96 MB of source, external domains: 0xray.ai, 127.0.0.1, api.example.com, api.github.com, auth.x.ai, codeload.github.com, example.com, github.com, img.shields.io, mcp-production-80e2.up.railway.app, opencode.ai, registry.npmjs.org, schema.getpostman.com, schema.org, www.google.com, www.sitemaps.org, www.typescriptlang.org, your-governance-endpoint.com

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/node/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/node/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/security/security-scanner.jsView file

6*/ L7: import { exec } from "child_process"; L8: import { promises as fs } from "fs";

High

Child Process

Package source references child process execution.

dist/security/security-scanner.jsView on unpkg · L6

11import { promptSecurityValidator, } from "./prompt-security-validator.js"; L12: const execAsync = promisify(exec); L13: export class SecurityScanner {

High

Shell

Package source references shell execution.

dist/security/security-scanner.jsView on unpkg · L11

dist/core/boot-orchestrator.jsView file

172try { L173: orchestratorModule = await import("../core/orchestrator"); L174: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/boot-orchestrator.jsView on unpkg · L172

scripts/node/postinstall.cjsView file

31function renderManagedAgents(packageRoot, targetDir) { L32: let content = fs.readFileSync(path.join(packageRoot, "AGENTS-consumer.md"), "utf8"); L33: const consumer = readPackageIdentity(path.join(targetDir, "package.json")); ... L55: function deployManagedAgents(packageRoot, targetDir, log) { L56: const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md"); L57: const agentsDest = path.join(targetDir, "AGENTS.md"); L58: if (!fs.existsSync(agentsConsumer)) return; ... L60: if (!fs.existsSync(agentsDest)) { L61: fs.writeFileSync(agentsDest, next); L62: return; ... L66: if (!parts || outsideRegionEdited(parts)) { L67: fs.writeFileSync(path.join(targetDir, "AGENTS.md.0xray-new"), next);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/node/postinstall.cjsView on unpkg · L31

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

scripts/foundry/mint-suit.cjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rn millplantprotocol.foundryplantdir(millpackageroot); } function emptyplantfiles() { return { skills: [], agents: [] }; } function catalogplant(kind, millpackageroot) { if (!kind || kind === "mill") { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const parsed = millplantprotocol.parseplanttoken(kind); if (!parsed || parsed.builtin) { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const pkgroot = millplantprotocol.resolvepackageroot(parsed.packagename, { targetdir: millpack

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/foundry/mint-suit.cjsView on unpkg

dist/integrations/grok/grok-cli.jsView file

9* L10: * Recommended registration (via npx or Grok's tooling): L11: * npx 0xray grok install ... L19: import path from 'path'; L20: import { execSync } from 'child_process'; L21: import { createRequire } from 'module';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/integrations/grok/grok-cli.jsView on unpkg · L9

dist/integrations/cursor/hooks/pre-compact.shView file

•path = [redacted]-compact.sh kind = build_helper sizeBytes = 130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/cursor/hooks/pre-compact.shView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 8140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 45568 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg

dist/cli/server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/cli/server.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High