registry / AI-agent control-surface risk / @ch4acko3/frontal-lobe

@ch4acko3/frontal-lobe

Frontal Lobe CLI, Gateway, Codex and Claude Code adapters, skills, and debug UI.

This report shows the evidence for @ch4acko3/frontal-lobe@0.1.12. 6 of 7 known versions are blocked or flagged. The newest version, 0.1.14, is blocked. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This meets the blocking policy because npm postinstall automatically mutates a foreign/broad AI-agent control surface. The package’s deferred hook-trust behavior reduces scope but does not undo the unconsented marketplace and plugin-source writes.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall in a noninteractive environment with Codex available

Impact

Unconsented persistence in a foreign AI-agent control surface; later plugin activation can run bundled hooks during Codex sessions.

Mechanism

automatic Codex plugin staging and marketplace mutation

Policy narrative

The package's postinstall selects all client adapters when it cannot prompt, then invokes its Codex plugin installer. That installer copies bundled plugin and hook code into the user's Codex home and updates `$HOME/.agents/plugins/marketplace.json`. This is an unconsented install-time mutation of a broad AI-agent plugin control surface; hook activation is deferred, but the registration and staged payload persist.

AI rationale

Evidence

package.jsonbin/frontal-codex-plugin-postinstall.mjslib/frontal-gateway/dist/codex-plugin-install.jslib/frontal-codex-adapter/.codex-plugin/plugin.jsonlib/frontal-codex-adapter/hooks/hooks.json$CODEX_HOME/.frontal-lobe/plugins/frontal-codex-adapter$HOME/.agents/plugins/marketplace.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

`package.json` runs `postinstall`.
Noninteractive postinstall selects all clients in `bin/frontal-codex-plugin-postinstall.mjs`.
Postinstall invokes `frontal codex-plugin install --json`.
`codex-plugin-install.js` stages code under `$CODEX_HOME/.frontal-lobe/plugins/frontal-codex-adapter`.
Installer rewrites `$HOME/.agents/plugins/marketplace.json`.
Bundled plugin declares Codex command hooks in `hooks/hooks.json`.

Evidence against

Postinstall does not auto-activate or trust hooks when it cannot prompt.
No `eval`, `Function`, or remote payload loader was confirmed.
Remote Memorax requests require separately configured credentials.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

14 flagged

package.jsonView file

Lines 33-56json

33 "frontal-core": "bin/frontal-core.mjs",

34 "frontal-gateway": "bin/frontal-gateway.mjs",

35 "frontal-gateway-profile": "bin/frontal-gateway-profile.mjs",

36 "frontal-mcp-server": "bin/frontal-mcp-server.mjs",

37 "frontal-terminal": "bin/frontal-terminal.mjs"

38 },

39 "files": [

40 "bin",

41 "docs",

42 "examples",

43 "lib",

44 "README.md"

45 ],

46 "engines": {

47 "node": ">=20"

48 },

49 "dependencies": {

50 "smol-toml": "^1.7.0"

51 },

52 "scripts": {

53 "postinstall": "node ./bin/frontal-codex-plugin-postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

54 }

55}

bin/frontal.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/frontal.mjsView on unpkg · L1

4import { homedir } from "node:os";

lib/frontal-gateway/dist/memory-viewer-session-names.jsView file

Lines 1-25javascript

1import { existsSync, readFileSync } from "node:fs";

2import { createRequire } from "node:module";

3import { homedir } from "node:os";

4import { basename, join } from

lib/frontal-gateway/dist/ui-observer-store.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { mkdirSync, readdirSync, renameSync, writeFileSync } from "node:fs";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/frontal-gateway/dist/ui-observer-store.jsView on unpkg · L1

3import { dirname, join } from "node:path";

lib/frontal-codex-adapter/src/macos-loopback-proxy-bypass.mjsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { randomUUID } from "node:crypto";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/frontal-codex-adapter/src/macos-loopback-proxy-bypass.mjsView on unpkg · L1

3import {

4 chmodSync,

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createHash } from "node:crypto";

4import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

5import

bin/frontal-codex-plugin-postinstall.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

4import { homedir } from "node:os";

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/frontal-core-nativeView file

•path = bin/frontal-core-native kind = native_binary sizeBytes = 7354640 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/frontal-core-nativeView on unpkg

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView file

•path = lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.py kind = build_helper sizeBytes = 19163 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView on unpkg

lib/frontal-gateway/dist/child-action-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.10 matchedPath = lib/frontal-gateway/dist/child-action-worker.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High