registry / @bitkyc08/opencodex / 2.6.18

@bitkyc08/opencodex@2.6.18

Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. The package is a user-invoked Codex/LLM proxy with powerful but package-aligned config, service, OAuth, and provider-network behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs ocx commands such as start, ensure, login, update, service install, or codex-shim install.

Impact

Routes Codex traffic through a local proxy and can persist service/shim state when explicitly invoked; no evidence of unauthorized exfiltration or install-time takeover.

Mechanism

local proxy routing, credential-backed provider adapters, optional service/shim installation

Rationale

Static inspection found high-risk primitives, but they are tied to the package's stated local Codex proxy, OAuth provider, update, service, and shim features and are not triggered at install/import time. No attacker-controlled endpoint, hidden payload, credential exfiltration, destructive action, or unconsented lifecycle AI-agent control-surface mutation was confirmed.

Evidence

package.jsonbin/ocx.mjsbin/package-main.mjssrc/cli.tssrc/codex-inject.tssrc/codex-shim.tssrc/service.tssrc/oauth/local-token-detect.tssrc/lib/gcp-adc.tssrc/oauth/store.tssrc/providers/registry.ts~/.opencodex/auth.json~/.opencodex/service-state.json~/.opencodex/codex-shim.json~/.codex/config.toml~/.codex/profiles/opencodex.toml~/Library/LaunchAgents/com.opencodex.proxy.plist~/.config/systemd/user/opencodex-proxy.service

Network endpoints10

oauth2.googleapis.com/tokenmetadata.google.internal/computeMetadata/v1/instance/service-accounts/default/tokenauth.openai.com/oauth/tokenchatgpt.com/backend-api/codexapi2.cursor.shapi.x.ai/v1api.anthropic.comapi.kimi.com/coding/v1runtime.us-east-1.kiro.devapi.openai.com/v1

Decision evidence

public snapshot

AI called this Clean at 80.0% confidence as Benign with medium false-positive risk.

Evidence for block

bin/ocx.mjs spawns bundled Bun and has user-invoked self-update paths using npm view/install.
src/codex-inject.ts can rewrite Codex config to route models through local opencodex proxy on start/ensure.
src/codex-shim.ts can replace PATH codex launcher with an autostart shim, but only via explicit codex-shim install.
src/service.ts can install login persistence via launchd/systemd/Task Scheduler when user runs ocx service install.
src/oauth/local-token-detect.ts reads local Grok/Claude credentials for import; src/lib/gcp-adc.ts reads ADC and may query Google metadata for Vertex tokens.

Evidence against

package.json has no install/postinstall/prepare lifecycle for consumers; prepublishOnly is publisher-side only.
bin/package-main.mjs only exports metadata and lazy Bun API import; no import-time credential or network behavior observed.
Credential reads and cloud metadata access are provider-auth flows aligned with proxy functionality, with tokens stored locally under opencodex auth/config paths.
Network endpoints are expected LLM/OAuth/provider endpoints from registry and auth modules, not attacker-controlled exfil endpoints.
Codex config/shim/service mutations are exposed as documented user commands or start/ensure behavior, not hidden install-time execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 158 file(s), 1.91 MB of source, external domains: 127.0.0.1, accounts.google.com, ai-gateway.vercel.sh, aiplatform.googleapis.com, aistudio.google.com, antigravity.google, api.anthropic.com, api.cerebras.ai, api.code.umans.ai, api.deepseek.com, api.fireworks.ai, api.githubcopilot.com, api.groq.com, api.kilo.ai, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.neuralwatt.com, api.openai.com, api.synthetic.new, api.together.xyz, api.venice.ai, api.x.ai, api.xiaomimimo.com, api.z.ai, api2.cursor.sh, app.umans.ai, auth.kimi.com, auth.openai.com, auth.x.ai, build.nvidia.com, chatgpt.com, claude.ai, cloud.cerebras.ai, cloud.gitlab.com, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, console.bce.baidu.com, console.cloud.google.com, console.groq.com, console.mistral.ai, cursor.com, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, dashscope.console.aliyun.com, docs.litellm.ai, fireworks.ai, gateway.ai.cloudflare.com

Source & flagged code

4 flagged

src/service.tsView file

Lines 1-27typescript

1/**

2 * `ocx service` — run the proxy as a background service that auto-starts on login and

3 * auto-restarts on crash. macOS → launchd; Windows → Task Scheduler; Linux → systemd user unit.

4 * The service sets OCX_SERVICE=1 so the proxy's shutdown handler does NOT restore native

5 * Codex on a service-managed restart (the restarted instance re-injects); explicit stop/uninstall

6 * restore it via the command.

7 */

8import { execFileSync, execSync } from "node:child_process";

9import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

10import { homedir } from "node:os";

11import { dirname, join, resolve } from "node:path";

12import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort } from "./config";

13import { loadConfig } from "./config";

14import { restoreNativeCodex } from "./codex-inject";

15import { durableBunPath, durableBunRuntime } from "./bun-runtime";

16import { isProcessAlive, stopProxy } from "./process-control";

17import { serviceApiTokenFilePath } from "./service-secrets";

18import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./win-paths";

20const LABEL = "com.opencodex.proxy";

21const TASK = "opencodex-proxy";

23function cliEntry(): { bun: string; cli: string } {

24 // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than

25 // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a

26 // standalone Bun is later removed. cli.ts sits next to this module.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.tsView on unpkg · L7

27 return { bun: durableBunPath(), cli: join(import.meta.dir, "cli.ts") };

src/oauth/local-token-detect.tsView file

Lines 1-25typescript

1/**

2 * Local token auto-detection — reads an existing Grok CLI credential (~/.grok/auth.json).

3 * Read-only: never writes to external credential stores.

4 * Ported from jawcode packages/ai/src/utils/oauth/local-token-detect.ts (xAI portion).

5 */

6import { execSync } from "node:child_process";

7import { existsSync, readFileSync } from "node:fs";

8import { homedir } from

src/lib/gcp-adc.tsView file

Lines 1-32typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).

8 * 3. GCE / Cloud Run metadata server.

9 *

10 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)

11 * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.

bin/ocx.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bitkyc08/opencodex@2.6.17 matchedIdentity = npm:QGJpdGt5YzA4L29wZW5jb2RleA:2.6.17 similarity = 0.454 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/ocx.mjsView on unpkg

Source & flagged code

4 flagged · loading source

src/service.tsView file

7*/ L8: import { execFileSync, execSync } from "node:child_process"; L9: import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; ... L24: // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than L25: // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a L26: // standalone Bun is later removed. cli.ts sits next to this module. ... L30: function plistPath(): string { L31: return join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`); L32: } ... L65: function currentCodexHome(): string { L66: const raw = process.env.CODEX_HOME?.trim(); L67: return raw ? resolve(expandUserPath(raw)) : join(homedir(), ".codex");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.tsView on unpkg · L7

src/oauth/local-token-detect.tsView file

5*/ L6: import { execSync } from "node:child_process"; L7: import { existsSync, readFileSync } from "node:fs"; ... L11: L12: const XAI_AUTH_KEY_PREFIX = "https://auth.x.ai::"; L13: const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials"; ... L15: export function detectGrokCliToken(): OAuthCredentials | null { L16: const authPath = join(homedir(), ".grok", "auth.json"); L17: if (!existsSync(authPath)) return null; ... L19: try { L20: const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, Record<string, unknown>>; L21:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/oauth/local-token-detect.tsView on unpkg · L5

src/lib/gcp-adc.tsView file

12* L13: * Security: never logs the access token, private key, or refresh token. L14: */ ... L23: L24: const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token"; L25: const METADATA_TOKEN_URL = "http://metadata.google.[redacted]-accounts/default/token"; L26: const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"; ... L40: client_email: string; L41: private_key: string; L42: private_key_id?: string; ... L63: function getRefreshSkewMs(): number { L64: const raw = Number(process.env.GOOGLE_VERTEX_REFRESH_SKEW_MS);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/lib/gcp-adc.tsView on unpkg · L12

bin/ocx.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/ocx.mjsView on unpkg

Findings

1 Critical2 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltabin/ocx.mjs

HighSandbox Evasion Gated Capabilitysrc/oauth/local-token-detect.ts

HighCloud Metadata Accesssrc/lib/gcp-adc.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/service.ts

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/service.tsView file

Lines 1-27typescript

1/**

2 * `ocx service` — run the proxy as a background service that auto-starts on login and

3 * auto-restarts on crash. macOS → launchd; Windows → Task Scheduler; Linux → systemd user unit.

4 * The service sets OCX_SERVICE=1 so the proxy's shutdown handler does NOT restore native

5 * Codex on a service-managed restart (the restarted instance re-injects); explicit stop/uninstall

6 * restore it via the command.

7 */

8import { execFileSync, execSync } from "node:child_process";

9import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

10import { homedir } from "node:os";

11import { dirname, join, resolve } from "node:path";

12import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort } from "./config";

13import { loadConfig } from "./config";

14import { restoreNativeCodex } from "./codex-inject";

15import { durableBunPath, durableBunRuntime } from "./bun-runtime";

16import { isProcessAlive, stopProxy } from "./process-control";

17import { serviceApiTokenFilePath } from "./service-secrets";

18import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./win-paths";

20const LABEL = "com.opencodex.proxy";

21const TASK = "opencodex-proxy";

23function cliEntry(): { bun: string; cli: string } {

24 // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than

25 // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a

26 // standalone Bun is later removed. cli.ts sits next to this module.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.tsView on unpkg · L7

27 return { bun: durableBunPath(), cli: join(import.meta.dir, "cli.ts") };

src/oauth/local-token-detect.tsView file

Lines 1-25typescript

1/**

2 * Local token auto-detection — reads an existing Grok CLI credential (~/.grok/auth.json).

3 * Read-only: never writes to external credential stores.

4 * Ported from jawcode packages/ai/src/utils/oauth/local-token-detect.ts (xAI portion).

5 */

6import { execSync } from "node:child_process";

7import { existsSync, readFileSync } from "node:fs";

8import { homedir } from

src/lib/gcp-adc.tsView file

Lines 1-32typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).

8 * 3. GCE / Cloud Run metadata server.

9 *

10 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)

11 * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.

bin/ocx.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/ocx.mjsView on unpkg