registry / @chenronggui/codex-win-patch / 0.150.1-patch.2

@chenronggui/codex-win-patch@0.150.1-patch.2

⚠ Under review

Unofficial Windows x64 binary overlay for the OpenAI Codex CLI.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.17 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 21-47json

21 ],

22 "engines": {

23 "node": ">=16"

24 },

25 "bin": {

26 "codex-win-patch-install": "bin/install.js",

27 "codex-win-patch-restore": "bin/restore.js"

28 },

29 "files": [

30 "bin",

31 "apply_patch.exe",

32 "build-info.json",

33 "codex.exe",

34 "install.ps1",

35 "LICENSE",

36 "README.md",

37 "restore.ps1",

38 "SHA256SUMS"

39 ],

40 "scripts": {

41 "postinstall": "node bin/install.js --postinstall"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "publishConfig": {

44 "access": "public",

45 "registry": "https://registry.npmjs.org/"

46 }

47}

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 311083520 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

@chenronggui/codex-win-patch@0.150.1-patch.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code