Loading npm security reports…

@0xmmo/crew@0.3.0: AI-agent control-surface risk | LPM Firewall

registry / @0xmmo/crew / 0.3.0

@0xmmo/crew@0.3.0

Let Claude Code, Codex, and opencode agents talk to each other: live shared context and agent-to-agent messaging across sessions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically changes hook controls for Claude, Codex, and opencode. The hooks run crew during agent events and insert shared session data or continuation instructions into agent context.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install -g @0xmmo/crew, unless CREW_NO_HOOK is set.

Impact

Future agent sessions can execute the package and receive content sourced from other local agent sessions or crew messages.

Mechanism

Postinstall mutation of multiple AI-agent hook and plugin control surfaces.

Policy narrative

On global installation, postinstall iterates over three agent products and installs command hooks or a generated plugin without an explicit setup command. Those hooks invoke crew at session events. Crew accepts hook input, reads local agent session material, and emits it as injected context; on stop events it can issue a blocking continuation reason. This is automatic persistence across foreign AI-agent control surfaces.

AI rationale

The package performs an unconsented global-install lifecycle mutation of multiple foreign AI-agent control surfaces, then injects content into their sessions. No network theft was found, but the concrete hook persistence and agent-control behavior meet the blocking policy.

Evidence

package.jsondist/postinstall.jsdist/settings.jsdist/crew.js$CODEX_HOME/hooks.json$CLAUDE_CONFIG_DIR/settings.json$XDG_CONFIG_HOME/opencode/plugins/crew.js

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

20"scripts": { "build": "tsc", "typecheck": "tsc --noEmit", "test": "npm run build && node --test test/*.test.cjs", "postinstall": "node dist/postinstall.js || true", "version": "node -e \"const fs=require('fs');const v=require('./package.json').version;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v;fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}\" && git add .claude-plugin/plugin.json .codex-plugin/plugin.json",

High

Suspicious Lifecycle Evidence

The postinstall lifecycle automatically runs its installer during global npm installation.

package.jsonView on unpkg · L20

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/settings.jsView file

10Object.defineProperty(exports, "__esModule", { value: true }); L11: exports.HOOK_EVENTS = exports.HOOK_COMMAND = exports.AGENT_LABELS = exports.AGENTS = void 0; L12: exports.tildify = tildify; ... L20: const opencode_1 = require("./opencode"); L21: exports.AGENTS = ["claude", "codex", "opencode"]; L22: exports.AGENT_LABELS = { ... L40: if (agent === "opencode") L41: return (0, opencode_1.opencodePluginPath)(); L42: if (agent === "codex") { L43: const dir = process.env.CODEX_HOME || (0, node_path_1.join)((0, node_os_1.homedir)(), ".codex"); L44: return (0, node_path_1.join)(dir, "hooks.json"); L45: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/settings.jsView on unpkg · L10

118for (const event of exports.HOOK_EVENTS) { const entries = (hooks[event] ??= []); if (!Array.isArray(entries)) { throw new Error(`hooks.${event} in ${path} is not an array`); } if (hasCrewHook(entries)) continue; entries.push({ hooks: [{ type: "command", command: exports.HOOK_COMMAND }] }); changed = true; } if (!changed) return "already-installed"; (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true }); (0, node_fs_1.writeFileSync)(path, JSON.stringify(settings, null, 2)

High

Ai Review Evidence

The installer modifies Claude and Codex hook configuration and creates a global opencode plugin.

dist/settings.jsView on unpkg · L118

dist/crew.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/crew.js#virtual:normalized:round1View on unpkg

dist/postinstall.jsView file

10function main() { if (process.env.CREW_NO_HOOK === "1") return; const isGlobal = process.env.npm[redacted] === "true" || process.env.npm[redacted] === "global"; if (!isGlobal) return; // local/dev install: don't touch user settings for (const agent of settings_1.AGENTS) { const shown = (0, settings_1.tildify)((0, settings_1.settingsPath)(agent)); try { if ((0, settings_1.installHook)(agent) === "installed") { process.stdout.write(`✓ crew wired into ${settings_1.AGENT_LABELS[agent]} (${shown}).\n`);

High

Ai Review Evidence

The installer modifies Claude and Codex hook configuration and creates a global opencode plugin.

dist/postinstall.jsView on unpkg · L10

Source & flagged code

7 flagged

package.jsonView file

Lines 1-44json

1{

2 "name": "@0xmmo/crew",

3 "version": "0.3.0",

4 "description": "Let Claude Code, Codex, and opencode agents talk to each other: live shared context and agent-to-agent messaging across sessions.",

5 "type": "commonjs",

6 "bin": {

7 "crew": "dist/crew.js"

8 },

9 "files": [

10 "dist",

11 ".claude-plugin",

12 ".codex-plugin",

13 "hooks",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "build": "tsc",

22 "typecheck": "tsc --noEmit",

23 "test": "npm run build && node --test test/*.test.cjs",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "version": "node -e \"const fs=require('fs');const v=require('./package.json').version;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v;fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}\" && git add .claude-plugin/plugin.json .codex-plugin/plugin.json",

High

Suspicious Lifecycle Evidence

The postinstall lifecycle automatically runs its installer during global npm installation.

package.jsonView on unpkg · L20

26 "send": "npm run build && node -e \"const fs=require('fs');const v=require('./package.json').version.split('.');v[2]=+v[2]+1;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v.join('.');fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}\" && git add . && (git diff --cached --quiet || git commit -am checkpoint) && npm version patch && npm login && npm publish"

27 },

28 "keywords": [

29 "claude",

30 "claude-code",

31 "codex",

32 "openai-codex",

33 "hooks",

34 "context",

35 "multi-agent",

36 "cli",

37 "sessions",

38 "agents",

39 "terminal",

40 "ndjson",

41 "opencode",

42 "opencode-plugin"

43 ],

44 "author": "",

dist/settings.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * settings.ts — wire crew's context hook into Claude Code, Codex, and opencode.

4 *

5 * Claude and Codex use the same hook event/config shape: crew is merged into

6 * each user hook file without touching unrelated settings, and never written

7 * over a file we cannot parse. opencode has no hook file; its "install" is a

8 * generated plugin dropped into the global plugins directory (see opencode.ts).

9 */

10Object.defineProperty

dist/crew.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/crew.js#virtual:normalized:round1View on unpkg

dist/postinstall.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * npm postinstall — auto-wire crew into Claude Code, Codex, and opencode.

4 *

5 * Runs only on global installs (`npm i -g`). Set CREW_NO_HOOK=1 to opt out.

6 * Never fails the install: errors are reported and swallowed.

7 */

8Object.defineProperty(exports, "__esModule", { value: true