registry / @bitkyc08/opencodex / 2.6.16

@bitkyc08/opencodex@2.6.16

Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a user-invoked Codex provider proxy with risky but package-aligned config, shim, OAuth, and service features.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs ocx commands such as start, ensure, login, service, or codex-shim install.

Impact

Routes Codex traffic through local opencodex proxy and configured upstream LLM/OAuth providers.

Mechanism

CLI proxy routing and explicit Codex configuration/shim mutation

Rationale

Static source inspection found powerful Codex-control and credential-handling primitives, but they are tied to the package's advertised proxy/login/autostart functionality and are not install-time or covert. No concrete exfiltration, persistence without user command, destructive behavior, or reviewer/prompt manipulation was identified.

Evidence

package.jsonbin/ocx.mjssrc/cli.tssrc/codex-inject.tssrc/codex-shim.tssrc/oauth/store.tssrc/oauth/local-token-detect.tssrc/lib/gcp-adc.ts~/.codex/config.toml~/.codex/opencodex.config.toml~/.codex/opencodex-catalog.json~/.opencodex/config.json~/.opencodex/auth.jsonPATH codex launcher backup .opencodex-real

Network endpoints7

chatgpt.com/backend-api/codexauth.openai.com/oauth/tokenapi.openai.com/v1api.x.ai/v1api.anthropic.comoauth2.googleapis.com/tokenmetadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.

Evidence for block

src/codex-shim.ts can user-invoked rename PATH codex launcher to .opencodex-real and write a wrapper.
src/codex-inject.ts user-invoked start/ensure writes ~/.codex/config.toml, opencodex profile, catalog, and history metadata.
src/oauth/local-token-detect.ts reads existing ~/.grok auth and macOS Claude Code keychain credentials for local import.
src/lib/gcp-adc.ts can read Google ADC files and request metadata server tokens for Vertex AI.

Evidence against

package.json has no install/postinstall lifecycle; prepublishOnly is publisher-side only.
bin/ocx.mjs only launches bundled Bun CLI; npm self-update runs only on explicit `ocx update`.
Codex config/shim/service mutations are exposed as documented CLI commands and include restore/uninstall paths.
Network endpoints are LLM/OAuth/provider APIs aligned with a Codex proxy, not hidden exfiltration endpoints.
Credential storage is local ~/.opencodex with hardened modes; tokens are used for selected providers.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 119 file(s), 1.19 MB of source, external domains: 127.0.0.1, accounts.google.com, ai-gateway.vercel.sh, aiplatform.googleapis.com, aistudio.google.com, antigravity.google, api.anthropic.com, api.cerebras.ai, api.code.umans.ai, api.deepseek.com, api.fireworks.ai, api.githubcopilot.com, api.groq.com, api.kilo.ai, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.neuralwatt.com, api.openai.com, api.synthetic.new, api.together.xyz, api.venice.ai, api.x.ai, api.xiaomimimo.com, api.z.ai, app.umans.ai, auth.kimi.com, auth.openai.com, auth.x.ai, build.nvidia.com, chatgpt.com, claude.ai, cloud.cerebras.ai, cloud.gitlab.com, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, console.bce.baidu.com, console.cloud.google.com, console.groq.com, console.mistral.ai, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, dashscope.console.aliyun.com, docs.litellm.ai, fireworks.ai, gateway.ai.cloudflare.com, generativelanguage.googleapis.com, github.com

Source & flagged code

7 flagged

bin/ocx.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * opencodex npm bin launcher.

4 *

5 * The package source is TypeScript that runs on the Bun runtime. To let

6 * `npm install -g @bitkyc08/opencodex` work without a separately-installed Bun,

7 * we bundle the runtime via the `bun` npm dependency and exec it from this

8 * Node shim. (Dev still runs `bun run src/cli.ts` directly via the shebang on

9 * src/cli.ts — only the published npm `bin` routes through here.)

10 */

11import { spawn, spawnSync } from "node:child_process";

12import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/ocx.mjsView on unpkg · L10

13import { existsSync, readFileSync, statSync } from "node:fs";

14import { homedir } from "node:os";

15import { dirname, join, resolve } from "node:path";

16import { fileURLToPath } from "node:url";

18const PKG = "@bitkyc08/opencodex";

19const require = createRequire(import.meta.url);

20const here = dirname(fileURLToPath(import.meta.url));

21const cliPath = join(here, "..", "src", "cli.ts");

23function isNodeModulesInstall() {

24 return here.split(/[\\/]/).includes("node_modules");

25}

27function isBunGlobalInstall() {

28 return /[\\/]\.bun[\\/]/.test(here);

29}

src/config.tsView file

Lines 413-453typescript

413 const pid = Number.parseInt(trimmed, 10);

414 return Number.isSafeInteger(pid) && pid > 0 ? pid : null;

415}

416

417export function

src/service.tsView file

Lines 1-27typescript

1/**

2 * `ocx service` — run the proxy as a background service that auto-starts on login and

3 * auto-restarts on crash. macOS → launchd; Windows → Task Scheduler; Linux → systemd user unit.

4 * The service sets OCX_SERVICE=1 so the proxy's shutdown handler does NOT restore native

5 * Codex on a service-managed restart (the restarted instance re-injects); explicit stop/uninstall

6 * restore it via the command.

7 */

8import { execFileSync, execSync } from "node:child_process";

9import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from

src/cli.tsView file

Lines 413-453typescript

413 const { removeCredential } = await import("./oauth/store");

414 const name = (args[1] ?? "").trim().toLowerCase();

415 removeCredential(name);

416 console.

src/oauth/local-token-detect.tsView file

Lines 1-25typescript

1/**

2 * Local token auto-detection — reads an existing Grok CLI credential (~/.grok/auth.json).

3 * Read-only: never writes to external credential stores.

4 * Ported from jawcode packages/ai/src/utils/oauth/local-token-detect.ts (xAI portion).

5 */

6import { execSync } from "node:child_process";

7import { existsSync, readFileSync } from "node:fs";

8import { homedir } from

src/lib/gcp-adc.tsView file

Lines 1-32typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).

8 * 3. GCE / Cloud Run metadata server.

9 *

10 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)

11 * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.

src/codex-catalog.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bitkyc08/opencodex@2.6.14 matchedIdentity = npm:QGJpdGt5YzA4L29wZW5jb2RleA:2.6.14 similarity = 0.898 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/codex-catalog.tsView on unpkg

Source & flagged code

7 flagged · loading source

bin/ocx.mjsView file

10*/ L11: import { spawn, spawnSync } from "node:child_process"; L12: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/ocx.mjsView on unpkg · L10

src/config.tsView file

433if (process.platform === "win32") { L434: const output = execFileSync("powershell.exe", [ L435: "-NoProfile",

High

Shell

Package source references shell execution.

src/config.tsView on unpkg · L433

src/service.tsView file

7*/ L8: import { execFileSync, execSync } from "node:child_process"; L9: import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; ... L23: // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than L24: // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a L25: // standalone Bun is later removed. cli.ts sits next to this module. ... L29: function plistPath(): string { L30: return join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`); L31: } ... L64: function currentCodexHome(): string { L65: return resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex")); L66: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.tsView on unpkg · L7

src/cli.tsView file

433console.log("Proxy not running. Starting..."); L434: const child = spawn(process.execPath, [process.argv[1], "start"], { L435: detached: true, ... L437: windowsHide: true, L438: env: process.env, L439: }); ... L445: const guiPort = runtimePort?.port ?? config.port; L446: const guiUrl = `http://localhost:${guiPort}`; L447: console.log(`Opening ${guiUrl}`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli.tsView on unpkg · L433

src/oauth/local-token-detect.tsView file

5*/ L6: import { execSync } from "node:child_process"; L7: import { existsSync, readFileSync } from "node:fs"; ... L11: L12: const XAI_AUTH_KEY_PREFIX = "https://auth.x.ai::"; L13: const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials"; ... L15: export function detectGrokCliToken(): OAuthCredentials | null { L16: const authPath = join(homedir(), ".grok", "auth.json"); L17: if (!existsSync(authPath)) return null; ... L19: try { L20: const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, Record<string, unknown>>; L21:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/oauth/local-token-detect.tsView on unpkg · L5

src/lib/gcp-adc.tsView file

12* L13: * Security: never logs the access token, private key, or refresh token. L14: */ ... L23: L24: const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token"; L25: const METADATA_TOKEN_URL = "http://metadata.google.[redacted]-accounts/default/token"; L26: const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"; ... L40: client_email: string; L41: private_key: string; L42: private_key_id?: string; ... L63: function getRefreshSkewMs(): number { L64: const raw = Number(process.env.GOOGLE_VERTEX_REFRESH_SKEW_MS);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/lib/gcp-adc.tsView on unpkg · L12

src/codex-catalog.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/codex-catalog.tsView on unpkg

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/codex-catalog.ts

HighChild Processbin/ocx.mjs

HighShellsrc/config.ts

HighSame File Env Network Executionsrc/cli.ts

HighSandbox Evasion Gated Capabilitysrc/oauth/local-token-detect.ts

HighCloud Metadata Accesssrc/lib/gcp-adc.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/service.ts

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/ocx.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * opencodex npm bin launcher.

4 *

5 * The package source is TypeScript that runs on the Bun runtime. To let

6 * `npm install -g @bitkyc08/opencodex` work without a separately-installed Bun,

7 * we bundle the runtime via the `bun` npm dependency and exec it from this

8 * Node shim. (Dev still runs `bun run src/cli.ts` directly via the shebang on

9 * src/cli.ts — only the published npm `bin` routes through here.)

10 */

11import { spawn, spawnSync } from "node:child_process";

12import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/ocx.mjsView on unpkg · L10

13import { existsSync, readFileSync, statSync } from "node:fs";

14import { homedir } from "node:os";

15import { dirname, join, resolve } from "node:path";

16import { fileURLToPath } from "node:url";

18const PKG = "@bitkyc08/opencodex";

19const require = createRequire(import.meta.url);

20const here = dirname(fileURLToPath(import.meta.url));

21const cliPath = join(here, "..", "src", "cli.ts");

23function isNodeModulesInstall() {

24 return here.split(/[\\/]/).includes("node_modules");

25}

27function isBunGlobalInstall() {

28 return /[\\/]\.bun[\\/]/.test(here);

29}

src/config.tsView file

Lines 413-453typescript

413 const pid = Number.parseInt(trimmed, 10);

414 return Number.isSafeInteger(pid) && pid > 0 ? pid : null;

415}

416

417export function

src/service.tsView file

Lines 1-27typescript

1/**

2 * `ocx service` — run the proxy as a background service that auto-starts on login and

3 * auto-restarts on crash. macOS → launchd; Windows → Task Scheduler; Linux → systemd user unit.

4 * The service sets OCX_SERVICE=1 so the proxy's shutdown handler does NOT restore native

5 * Codex on a service-managed restart (the restarted instance re-injects); explicit stop/uninstall

6 * restore it via the command.

7 */

8import { execFileSync, execSync } from "node:child_process";

9import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from

src/cli.tsView file

Lines 413-453typescript

413 const { removeCredential } = await import("./oauth/store");

414 const name = (args[1] ?? "").trim().toLowerCase();

415 removeCredential(name);

416 console.

src/oauth/local-token-detect.tsView file

Lines 1-25typescript

1/**

2 * Local token auto-detection — reads an existing Grok CLI credential (~/.grok/auth.json).

3 * Read-only: never writes to external credential stores.

4 * Ported from jawcode packages/ai/src/utils/oauth/local-token-detect.ts (xAI portion).

5 */

6import { execSync } from "node:child_process";

7import { existsSync, readFileSync } from "node:fs";

8import { homedir } from

src/lib/gcp-adc.tsView file

Lines 1-32typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).

8 * 3. GCE / Cloud Run metadata server.

9 *

10 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)

11 * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.

src/codex-catalog.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/codex-catalog.tsView on unpkg