@chenronggui/codex-win-patch@0.153.4-patch.2: Malicious npm | LPM Firewall

Loading npm security reports…

@chenronggui/codex-win-patch@0.153.4-patch.2: Malicious npm | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"scripts": { "postinstall": "node bin/install.js --postinstall" }

High

Suspicious Lifecycle Evidence

A postinstall hook automatically launches the installer.

package.jsonView on unpkg · L40

•scripts.postinstall = node bin/install.js --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 296022016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

bin/powershell.jsView file

•matchType = malicious_source_fingerprint_signature signature = bde713c797513693 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @chenronggui/codex-win-patch@0.153.4-patch.3 matchedPath = bin/powershell.js matchedIdentity = npm:[redacted]:0.153.4-patch.3 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/powershell.jsView on unpkg

22const scriptPath = path.join(__dirname, "..", scriptName); const commandArgs = [ "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", scriptPath, ...args, ]; for (const command of powershellCandidates()) { const result = spawnSync(command, commandArgs, { stdio: "inherit", windowsHide: true, });

High

Ai Review Evidence

The launcher invokes PowerShell with ExecutionPolicy Bypass.

bin/powershell.jsView on unpkg · L22

install.ps1View file

91$candidates = @( (Join-Path $GlobalNpmRoot "@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\node_modules\@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\vendor\$TargetTriple") ) foreach ($candidate in $candidates) { $manifest = Join-Path $candidate "codex-package.json" $entrypoint = Join-Path $candidate "bin\codex.exe" if ((Test-Path -LiteralPath $manifest -PathType Leaf) -and (Test-Path -LiteralPath $entrypoint -PathType

High

Ai Review Evidence

The installer targets @openai Codex package locations.

install.ps1View on unpkg · L91

Source & flagged code

8 flagged

package.jsonView file

Lines 20-47json

20 "x64"

21 ],

22 "engines": {

23 "node": ">=16"

24 },

25 "bin": {

26 "codex-win-patch-install": "bin/install.js",

27 "codex-win-patch-restore": "bin/restore.js"

28 },

29 "files": [

30 "bin",

31 "apply_patch.exe",

32 "build-info.json",

33 "codex.exe",

34 "install.ps1",

35 "LICENSE",

36 "README.md",

37 "restore.ps1",

38 "SHA256SUMS"

39 ],

40 "scripts": {

41 "postinstall": "node bin/install.js --postinstall"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

High

Suspicious Lifecycle Evidence

A postinstall hook automatically launches the installer.

package.jsonView on unpkg · L40

43 "publishConfig": {

44 "access": "public",

45 "registry": "https://registry.npmjs.org/"

46 }

47}

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 296022016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

bin/powershell.jsView file

Lines 2-42javascript

2const path = require("node:path");

3

4function powershellCandidates() {

5 const configured = process.env.CODEX_WINDOWS_PATCH_POWERSHELL;

install.ps1View file

Lines 71-111text

71 if (-not [string]::IsNullOrWhiteSpace($NpmRoot)) {

72 if (-not (Test-Path -LiteralPath $NpmRoot -PathType Container)) {

73 throw "The npm root does not exist: $NpmRoot"

74 }

75 return (Resolve-Path -LiteralPath $NpmRoot).Path

76 }

77

78 $detectedRoot = (& npm root -g 2>&1 | Out-String).Trim()

79 if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($detectedRoot)) {

80 throw "Could not locate the global npm root. Install npm or pass -NpmRoot explicitly."

81 }

82 if (-not (Test-Path -LiteralPath $detectedRoot -PathType Container)) {