registry / @0xmmo/crew / 0.3.2

@0xmmo/crew@0.3.2

⚠ Under review

Let Claude Code, Codex, and OpenCode agents talk to each other: live shared context and agent-to-agent messaging across sessions.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 78.0 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 4-44json

4 "description": "Let Claude Code, Codex, and OpenCode agents talk to each other: live shared context and agent-to-agent messaging across sessions.",

5 "type": "commonjs",

6 "bin": {

7 "crew": "dist/crew.js"

8 },

9 "files": [

10 "dist",

11 ".claude-plugin",

12 ".codex-plugin",

13 "hooks",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "build": "tsc",

22 "typecheck": "tsc --noEmit",

23 "test": "npm run build && node --test test/*.test.cjs",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "version": "npm run sync-manifests && git add .claude-plugin/plugin.json .codex-plugin/plugin.json",

26 "send": "npm run build && npm test && npm version patch --no-git-tag-version && npm run sync-manifests && git add -A && git commit -m \"$(node -p \"'v'+require('./package.json').version\")\" && git tag \"$(node -p \"'v'+require('./package.json').version\")\" && npm login && npm publish && git push origin main --tags",

27 "sync-manifests": "node -e \"const fs=require('fs');const v=JSON.parse(fs.readFileSync('package.json','utf8')).version;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v;fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}console.log('manifests synced to '+v)\""

28 },

29 "keywords": [

30 "claude",

31 "claude-code",

32 "codex",

33 "openai-codex",

34 "hooks",

35 "context",

36 "multi-agent",

37 "cli",

38 "sessions",

39 "agents",

40 "terminal",

41 "ndjson",

42 "opencode",

43 "opencode-plugin"

44 ],

dist/settings.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * settings.ts — wire crew's context hook into Claude Code, Codex, and OpenCode.

4 *

5 * Claude and Codex use the same hook event/config shape: crew is merged into

6 * each user hook file without touching unrelated settings, and never written

7 * over a file we cannot parse. OpenCode has no hook file; its "install" is a

8 * generated plugin dropped into the global plugins directory (see opencode.ts).

9 */

10Object.defineProperty

dist/crew.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/crew.js#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/settings.jsView file

10Object.defineProperty(exports, "__esModule", { value: true }); L11: exports.HOOK_EVENTS = exports.HOOK_COMMAND = exports.AGENT_LABELS = exports.AGENTS = void 0; L12: exports.tildify = tildify; ... L20: const opencode_1 = require("./opencode"); L21: exports.AGENTS = ["claude", "codex", "opencode"]; L22: exports.AGENT_LABELS = { ... L40: if (agent === "opencode") L41: return (0, opencode_1.opencodePluginPath)(); L42: if (agent === "codex") { L43: const dir = process.env.CODEX_HOME || (0, node_path_1.join)((0, node_os_1.homedir)(), ".codex"); L44: return (0, node_path_1.join)(dir, "hooks.json"); L45: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/settings.jsView on unpkg · L10

dist/crew.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/crew.js#virtual:normalized:round1View on unpkg

Findings

1 Critical2 High3 Medium3 Low

CriticalAi Agent Control Hijackdist/settings.js

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/crew.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @0xmmo/crew@0.3.2.

See version security history for other recorded verdicts.

Review the evidence and your use of @0xmmo/crew@0.3.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 23:23:50.287Z (UTC).