registry / AI-agent capability abuse / 0xray / 4.0.37

0xray@4.0.37

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Concrete source shows explicit-user-command agent control-surface mutation, which the supplied policy classifies as warning-only. The active postinstall does not establish the unconsented agent mutation required for blocking.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs 0xray wear or 0xray skill:install with a repository source.

Impact

Installed instructions and hooks can influence subsequent agent behavior. Activation through explicit commands prevents classifying these writes as unconsented npm install abuse.

Mechanism

Wear writes agent configuration and hooks; skill installation copies repository instructions and supporting files into the agent skills directory.

AI rationale

Evidence

dist/cli/index.jsscripts/node/wear-cursor-hooks.cjsscripts/node/install-bridges.cjsdist/cli/commands/skill-install.jsAGENTS.md.mcp.jsonopencode.json.cursor/hooks.json.opencode/skills

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall calls the vendored dependency linker rather than the agent setup functions.
The explicit wear command invokes project agent setup through wear-cursor-hooks.cjs.
Wear installs agent instructions and multiple platform bridges, and writes Cursor hook configuration with a saved snapshot.
The explicit skill:install command installs repository-supplied skill instructions and supporting files into the project's agent skills directory.

Evidence against

No unconsented install-time agent configuration mutation was established.
The runtime dependency list contains no dependency on 0xray itself.
The inspected configuration changes are activated by explicit user commands; no covert credential export was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

25 flagged

package.jsonView file

Lines 73-113json

73 "test": "vitest run",

74 "test:batch": "npm test",

75 "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",

76 "test:core-framework": "npm test -- src/__tests__/unit/v2-deletion-protection.test.ts",

77 "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",

78 "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

79 "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",

80 "test:code-analysis": "npm test -- src/__tests__/unit/codebase-context-analyzer.test.ts src/__tests__/unit/dependency-graph-builder.test.ts src/__tests__/unit/rule-enforcer.test.ts src/__tests__/unit/codex-parser.test.ts src/__tests__/unit/codex-injector.test.ts",

81 "test:processors": "npm test -- src/__tests__/unit/processor-activation.test.ts src/__tests__/unit/typescript-compilation-processor.test.ts",

82 "test:miscellaneous": "npm test -- src/__tests__/unit/blocked-test.test.ts",

83 "test:grok-bot": "npm test -- src/__tests__/unit/grok-bot-seat-doctor.test.ts src/__tests__/unit/grok-bot-op-proc-map.test.ts src/__tests__/unit/lead-cadence.test.ts src/__tests__/unit/grok-bot-auto-review-policy.test.ts",

84 "test:quick": "npm test -- src/__tests__/integration/boot-orchestrator.integration.test.ts src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts",

85 "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous && npm test -- src/__tests__/unit/llm-governance-provider.test.ts src/__tests__/unit/mcp-server-smoke.test.ts src/__tests__/unit/cursor-hooks.test.ts src/__tests__/unit/host-vs-mill-score.test.ts src/__tests__/unit/wear-pack-file-list.test.ts && npm run test:grok-bot",

86 "test:integration-all": "npm test -- src/__tests__/integration/",

87 "test:performance-all": "npm test -- src/__tests__/performance/ src/__tests__/unit/performance-system.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",

88 "test:agents-all": "echo 'Legacy agents test entry retired'",

89 "test:infrastructure": "npm test -- src/__tests__/infrastructure/",

90 "test:root": "npm test -- src/__tests__/integration/server.test.ts src/__tests__/framework-enforcement-integration.test.ts",

91 "test:pipelines": "node src/__tests__/pipeline/run-all-pipelines.mjs",

92 "test:full-suite": "npm run typecheck && npm run test:integration-all && npm run test:performance-all && npm run test:infrastructure && npm run test:root",

93 "postinstall": "node scripts/node/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "setup-dev": "node scripts/node/setup-dev.cjs",

95 "prepare-consumer": "node scripts/node/prepare-consumer.cjs",

96 "typecheck": "tsc --noEmit",

97 "lint": "eslint -c tests/config/eslint.config.js src",

98 "lint:fix": "eslint src --fix",

99 "security-audit": "npm audit || true",

100 "test:security-audit": "npm run test:security",

101 "test:dependency-scan": "npm run security-audit",

102 "test:integration": "node scripts/mjs/test-consumer-readiness.mjs && node scripts/mjs/test-mcp-functionality.mjs",

103 "test:e2e": "node scripts/node/validate-mcp-connectivity.js && node scripts/node/validate-external-processes.js",

104 "live-feedback-session": "npx --yes tsx scripts/live-taskhandler-feedback-session.ts",

105 "validate": "echo \"[xray] Use 'npm test' or 'npm run test:comprehensive'.\"",

106 "validate:quick": "npm run validate",

107 "debug:inference:force": "XRAY_FORCE_MCP_GOVERNANCE=true XRAY_DEV_PATH=dist node dist/cli/index.js inference:run --force",

108 "validate:full": "npm run validate",

109 "test:unified": "node scripts/test/test-unified-framework.mjs",

110 "test:consumer": "node scripts/mjs/test-consumer-readiness.mjs",

111 "config:setup": "node scripts/config/utils.js setup-dev",

112 "monitoring:start": "node scripts/monitoring/daemon.js start",

113 "monitoring:stop": "node scripts/monitoring/daemon.js stop",

dist/security/security-scanner.jsView file

Lines 1-31javascript

1/**

2 * 0xRay Framework - Security Scanner

3 *

4 * Automated security vulnerability scanning and compliance validation

5 * Integrates with security tools and provides comprehensive security reports

6 */

7import { exec } from "child_process";

8import { promises as fs }

dist/core/boot-orchestrator.jsView file

Lines 152-192javascript

152 this.pluginServerRegistry = new PluginServerConfigRegistry();

153 const registered = this.pluginServerRegistry.registerAllPluginServers(this.pluginRegistry, { overwrite: false });

154

scripts/node/postinstall.cjsView file

Lines 11-51javascript

11 listConsumerSkillNames,

12 listConsumerAgentFiles,

13 loadFoundryParams,

14 readPackageIdentity,

15} = require("../foundry/mint-suit.cjs");

17const XRAY_MANAGED_AGENTS_MARKER = "";

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.7 matchedPath = dist/scripts/pre-command.mjs matchedIdentity = npm:MHhyYXk:4.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/pre-command.mjsView on unpkg

scripts/foundry/mint-suit.cjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rn millplantprotocol.foundryplantdir(millpackageroot); } function emptyplantfiles() { return { skills: [], agents: [] }; } function catalogplant(kind, millpackageroot) { if (!kind || kind === "mill") { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const parsed = millplantprotocol.parseplanttoken(kind); if (!parsed || parsed.builtin) { const spec = factory_plant_catalog.mill; return spec ? { skills: [...spec.skills], agents: [...spec.agents] } : emptyplantfiles(); } const pkgroot = millplantprotocol.resolvepackageroot(parsed.packagename, { targetdir: millpack

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/foundry/mint-suit.cjsView on unpkg

dist/integrations/grok/grok-cli.jsView file

Lines 1-29javascript

1/**

2 * Grok CLI Integration for 0xRay

3 *

4 * This module provides the integration points for using 0xRay with the official Grok CLI.

5 *

6 * Primary mechanism: MCP (Model Context Protocol)

7 * Grok CLI can consume MCP servers. By registering the 0xRay MCP servers,

8 * users get access to Governance, skills, and other capabilities directly inside Grok conversations.

9 *

10 * Recommended registration (via npx or Grok's tooling):

dist/integrations/cursor/hooks/pre-compact.shView file

•path = [redacted]-compact.sh kind = build_helper sizeBytes = 130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/cursor/hooks/pre-compact.shView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 8140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 46866 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg

dist/cli/commands/mcp-install.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.28 matchedPath = dist/cli/commands/mcp-install.js matchedIdentity = npm:MHhyYXk:4.0.28 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/mcp-install.jsView on unpkg

dist/cli/commands/skill-install.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/cli/commands/sk[redacted] matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/skill-install.jsView on unpkg

dist/integrations/hooks/pipeline-hook-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = [redacted]-hook-runtime.mjs matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/hooks/pipeline-hook-runtime.mjsView on unpkg

dist/execution/opencode-cli-invoker.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/execution/opencode-cli-invoker.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/execution/opencode-cli-invoker.jsView on unpkg

dist/integrations/plugins/plugin-integration.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = [redacted]-integration.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/plugins/plugin-integration.jsView on unpkg

dist/mcps/boot-orchestrator.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/mcps/boot-orchestrator.server.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/boot-orchestrator.server.jsView on unpkg

dist/mcps/security-scan.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/mcps/security-scan.server.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/security-scan.server.jsView on unpkg

dist/governance/llm-governance-provider.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/governance/llm-governance-provider.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/governance/llm-governance-provider.jsView on unpkg

dist/mcps/auto-format.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/mcps/auto-format.server.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/auto-format.server.jsView on unpkg

dist/mcps/connection/process-spawner.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/mcps/connection/process-spawner.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/connection/process-spawner.jsView on unpkg

dist/mcps/knowledge-skills/performance-optimization.server.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.21 matchedPath = dist/mcps/knowledge-skills/performance-optimization.server.js matchedIdentity = npm:MHhyYXk:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcps/knowledge-skills/performance-optimization.server.jsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/node/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/node/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/security/security-scanner.jsView file

6*/ L7: import { exec } from "child_process"; L8: import { promises as fs } from "fs";

High

Child Process

Package source references child process execution.

dist/security/security-scanner.jsView on unpkg · L6

Findings

2 Critical20 High6 Medium5 Low

CriticalAi Agent Control Hijackscripts/node/postinstall.cjs

CriticalTrigger Reachable Excluded Directory Payloaddist/cli/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/security/security-scanner.js

HighShelldist/security/security-scanner.js

HighExternal Ai Agent Control Surface Mutationdist/scripts/pre-command.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/foundry/mint-suit.cjs

HighRuntime Package Installdist/integrations/grok/grok-cli.js

HighPayload In Excluded Dir.opencode/init.sh

HighSemantic Analysis Limiteddist/core/framework-logger.js

Affected versions and remediation

This report applies to 0xray@4.0.37.

See all versions of 0xray for other recorded verdicts.

Review the evidence and your use of 0xray@4.0.37 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-03 00:12:54.712Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code