Loading npm security reports…

@ch4acko3/frontal-lobe@0.1.12: AI-agent policy block | LPM Firewall

registry / @ch4acko3/frontal-lobe / 0.1.12

@ch4acko3/frontal-lobe@0.1.12

Frontal Lobe CLI, Gateway, Codex and Claude Code adapters, skills, and debug UI.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. On noninteractive npm install, the package auto-registers a bundled Codex plugin. It copies hook-capable code into `CODEX_HOME` and mutates the user-wide agent marketplace without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall in a noninteractive environment with Codex available

Impact

Unconsented persistence in a foreign AI-agent control surface; later plugin activation can run bundled hooks during Codex sessions.

Mechanism

automatic Codex plugin staging and marketplace mutation

Policy narrative

The package's postinstall selects all client adapters when it cannot prompt, then invokes its Codex plugin installer. That installer copies bundled plugin and hook code into the user's Codex home and updates `$HOME/.agents/plugins/marketplace.json`. This is an unconsented install-time mutation of a broad AI-agent plugin control surface; hook activation is deferred, but the registration and staged payload persist.

Rationale

This meets the blocking policy because npm postinstall automatically mutates a foreign/broad AI-agent control surface. The package’s deferred hook-trust behavior reduces scope but does not undo the unconsented marketplace and plugin-source writes.

Evidence

package.jsonbin/frontal-codex-plugin-postinstall.mjslib/frontal-gateway/dist/codex-plugin-install.jslib/frontal-codex-adapter/.codex-plugin/plugin.jsonlib/frontal-codex-adapter/hooks/hooks.json$CODEX_HOME/.frontal-lobe/plugins/frontal-codex-adapter

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/frontal-codex-plugin-postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/frontal.mjsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/frontal.mjsView on unpkg · L1

lib/frontal-gateway/dist/memory-viewer-session-names.jsView file

5import { [redacted], } from "./memory-viewer-session-title.js"; L6: const require = createRequire(import.meta.url); L7: export function memoryViewerSessionNames(sessionIds, frontalHome, env = process.env, titleCandidates = []) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/frontal-gateway/dist/memory-viewer-session-names.jsView on unpkg · L5

lib/frontal-gateway/dist/ui-observer-store.jsView file

1import { createHash } from "node:crypto"; L2: import { mkdirSync, readdirSync, renameSync, writeFileSync } from "node:fs";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/frontal-gateway/dist/ui-observer-store.jsView on unpkg · L1

lib/frontal-codex-adapter/src/macos-loopback-proxy-bypass.mjsView file

1import { spawnSync } from "node:child_process"; L2: import { randomUUID } from "node:crypto"; ... L22: const SCUTIL = "/usr/sbin/scutil"; L23: const LAUNCHCTL = "/bin/launchctl"; L24: const HELPER_FILENAME = "ensure-loopback-proxy-bypass.sh"; ... L34: export async function ensureMacosLoopbackProxyBypass(options = {}) { L35: if ((options.platform ?? process.platform) !== "darwin") return skipped("platform_not_supported"); L36: if (options.codexSelected === false) return skipped("codex_not_selected"); ... L43: if (!proxyCommand.ok) return proxyStatusUnknown(); L44: const proxyState = parseMacosProxyState(proxyCommand.stdout); L45: if (!proxyState.ok) return proxyStatusUnknown(); ... L246: export function macosLoopbackProxyBypassPaths(options = {}) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/frontal-codex-adapter/src/macos-loopback-proxy-bypass.mjsView on unpkg · L1

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { createHash } from "node:crypto"; ... L8: L9: const DEBUG = process.env.FRONTAL_CODEX_HOOK_DEBUG === "1"; L10: ... L13: const input = await readStdinJson(); L14: const gatewayUrl = normalizeUrl(process.env.FRONTAL_GATEWAY_URL || "http://127.0.0.1:8787"); L15: const timeoutMs = parsePositiveInt(process.env.FRONTAL_CODEX_ENSURE_TIMEOUT_MS, 1500);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView on unpkg · L1

bin/frontal-codex-plugin-postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L2: import { spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L136: sk[redacted], L137: claudeAdapterRequired: !sk[redacted] && !preflight.claudeOfficialLogin, L138: claudeSkipReason, ... L665: const clients = parse(readFileSync(path, "utf8"))?.clients; L666: if (!clients || typeof clients !== "object" || typeof clients.codex !== "boolean" || typeof clients.claude !== "boolean") return undefined; L667: return [clients.codex ? "codex" : undefined, clients.claude ? "claude" : undefined].filter(Boolean); L668: } catch { ... L779: const path = frontalConfigPath(); L780: mkdirSync(dirname(path), { recursive: true }); Paylo

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/frontal-codex-plugin-postinstall.mjsView on unpkg · L1

bin/frontal-core-nativeView file

•path = bin/frontal-core-native kind = native_binary sizeBytes = 7354640 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/frontal-core-nativeView on unpkg

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView file

•path = lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.py kind = build_helper sizeBytes = 19163 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView on unpkg

lib/frontal-gateway/dist/child-action-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.10 matchedPath = lib/frontal-gateway/dist/child-action-worker.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-gateway/dist/child-action-worker.jsView on unpkg

lib/frontal-gateway/dist/codex-smoke.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.10 matchedPath = lib/frontal-gateway/dist/codex-smoke.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-gateway/dist/codex-smoke.jsView on unpkg

lib/frontal-gateway/dist/repository-memory-scope.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.10 matchedPath = lib/frontal-gateway/dist/repository-memory-scope.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-gateway/dist/repository-memory-scope.jsView on unpkg

lib/frontal-gateway/dist/runtime-client.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.10 matchedPath = lib/frontal-gateway/dist/runtime-client.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-gateway/dist/runtime-client.jsView on unpkg

lib/frontal-codex-adapter/src/cli.mjsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.10 matchedPath = lib/frontal-codex-adapter/src/cli.mjs matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-codex-adapter/src/cli.mjsView on unpkg