@chenronggui/codex-win-patch@0.153.4-patch.1: AI-agent | LPM Firewall

Loading npm security reports…

@chenronggui/codex-win-patch@0.153.4-patch.1: AI-agent | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node bin/install.js --postinstall" }

High

Suspicious Lifecycle Evidence

Its postinstall automatically starts the installer.

package.jsonView on unpkg · L40

•scripts.postinstall = node bin/install.js --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 294728704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

install.ps1View file

91$candidates = @( (Join-Path $GlobalNpmRoot "@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\node_modules\@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\vendor\$TargetTriple") )

High

Ai Review Evidence

The installer locates the separately installed @openai Codex executable.

install.ps1View on unpkg · L91

216Write-Step "Installing codex.exe and native apply_patch.exe" [IO.Directory]::CreateDirectory($pathDirectory) | Out-Null Copy-FileReplacing $codexSource $codexTarget Copy-FileReplacing $applyPatchSource $applyPatchTarget

High

Ai Review Evidence

It copies package-supplied executables over that foreign Codex installation.

install.ps1View on unpkg · L216

bin/powershell.jsView file

22const scriptPath = path.join(__dirname, "..", scriptName); const commandArgs = [ "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", scriptPath, ...args, ]; for (const command of powershellCandidates()) { const result = spawnSync(command, commandArgs, { stdio: "inherit", windowsHide: true,

High

Ai Review Evidence

The launcher invokes PowerShell with execution-policy bypass.

bin/powershell.jsView on unpkg · L22

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node bin/install.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node bin/install.js --postinstall" }

High

Suspicious Lifecycle Evidence

Its postinstall automatically starts the installer.

package.jsonView on unpkg · L40

•scripts.postinstall = node bin/install.js --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 294728704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

install.ps1View file

91$candidates = @( (Join-Path $GlobalNpmRoot "@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\node_modules\@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\vendor\$TargetTriple") )

High

Ai Review Evidence

The installer locates the separately installed @openai Codex executable.

install.ps1View on unpkg · L91

216Write-Step "Installing codex.exe and native apply_patch.exe" [IO.Directory]::CreateDirectory($pathDirectory) | Out-Null Copy-FileReplacing $codexSource $codexTarget Copy-FileReplacing $applyPatchSource $applyPatchTarget

High

Ai Review Evidence

It copies package-supplied executables over that foreign Codex installation.

install.ps1View on unpkg · L216

bin/powershell.jsView file

22const scriptPath = path.join(__dirname, "..", scriptName); const commandArgs = [ "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", scriptPath, ...args, ]; for (const command of powershellCandidates()) { const result = spawnSync(command, commandArgs, { stdio: "inherit", windowsHide: true,

High

Ai Review Evidence

The launcher invokes PowerShell with execution-policy bypass.

bin/powershell.jsView on unpkg · L22