registry / @brimveyn/aimux / 1.19.0

@brimveyn/aimux@1.19.0

A terminal multiplexer for AI CLIs. Run Claude, Codex, OpenCode side-by-side with tabbed navigation, split panes, and persistent sessions.

AI Security Review

scanned 12h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A config-gated Claude integration changes Claude Code's local theme preference and writes an aimux-owned theme file. A separate config-gated hook installer is inert in this tarball because its referenced hook script is absent. No install-time or covert exfiltration path was confirmed.

Static reason

No blocking static signals were detected.

Trigger

User starts aimux with Claude theme or hooks integration enabled in their configuration.

Impact

Changes local Claude Code behavior/theme; no concrete malicious payload or unconsented install-time control-surface mutation was found.

Mechanism

Opt-in mutation of first-party Claude Code integration settings.

Rationale

The package is not malicious by source evidence, but it has a guarded first-party AI-agent integration that mutates Claude Code configuration. Per firewall policy, retain this as a warn-level agent extension lifecycle risk rather than block it.

Evidence

package.jsonsrc/index.tsxsrc/config/loader.tssrc/app.tsxsrc/integrations/claude-theme-sync.tssrc/integrations/claude-hooks-install.tssrc/integrations/claude-hook-server.tssrc/services/ai-usage/adapters/codex.ts~/.claude/settings.json~/.claude/themes/aimux.json~/.codex/auth.json~/.cache/aimux/ai-usage.json

@brimveyn/aimux@1.19.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code