Loading npm security reports…

@chenronggui/codex-win-patch@0.155.1-patch.1: AI-agent | LPM Firewall

registry / @chenronggui/codex-win-patch / 0.155.1-patch.1

@chenronggui/codex-win-patch@0.155.1-patch.1

面向 OpenAI Codex CLI 的非官方 Windows x64 补丁。

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On global installation, the package automatically overwrites the installed official Codex executable and helper with opaque package-supplied binaries. This mutates a foreign AI-agent control surface before the user runs the package command.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Global npm installation with lifecycle scripts enabled.

Impact

Subsequent Codex use executes unverified third-party binaries instead of the installed official binaries.

Mechanism

Postinstall PowerShell replacement of @openai Codex binaries.

Policy narrative

The postinstall hook invokes the installer during global installation. It finds the @openai Codex platform package, backs up its executables, replaces them with this package's bundled binaries, and executes the replacement for a version check. The replacement payload is opaque native code, so its later agent behavior cannot be verified from the package scripts.

AI rationale

This is an unconsented automatic lifecycle mutation of a foreign AI-agent executable with opaque payloads. The package's backup and checksum checks do not remove the control-hijack risk.

Evidence

package.jsonbin/powershell.jsinstall.ps1@openai/codex/node_modules/@openai/codex-win32-x64/vendor/x86_64-pc-windows-msvc/bin/codex.exe@openai/codex/node_modules/@openai/codex-win32-x64/vendor/x86_64-pc-windows-msvc/codex-path/apply_patch.execodex.exe

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

41"scripts": { "postinstall": "node bin/install.js --postinstall" }

High

Suspicious Lifecycle Evidence

The package automatically runs its installer in postinstall.

package.jsonView on unpkg · L41

•scripts.postinstall = node bin/install.js --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 307329536 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

bin/powershell.jsView file

•matchType = malicious_source_fingerprint_signature signature = bde713c797513693 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @chenronggui/codex-win-patch@0.153.4-patch.7 matchedPath = bin/powershell.js matchedIdentity = npm:[redacted]:0.153.4-patch.7 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/powershell.jsView on unpkg

22const scriptPath = path.join(__dirname, "..", scriptName); const commandArgs = [ "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", scriptPath, ...args, ]; for (const command of powershellCandidates()) { const result = spawnSync(command, commandArgs, { stdio: "inherit", windowsHide: true, });

High

Suspicious Lifecycle Evidence

The postinstall entry invokes PowerShell with execution-policy bypass.

bin/powershell.jsView on unpkg · L22

install.ps1View file

91$candidates = @( (Join-Path $GlobalNpmRoot "@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\node_modules\@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\vendor\$TargetTriple") ) foreach ($candidate in $candidates) { $manifest = Join-Path $candidate "codex-package.json" $entrypoint = Join-Path $candidate "bin\codex.exe" if ((Test-Path -LiteralPath $manifest -PathType Leaf) -and (Test-Path -LiteralPath $entrypoint -PathType Le…

High

Ai Review Evidence

The installer locates the separately installed @openai Codex Windows executable.

install.ps1View on unpkg · L91

215try { Write-Step "Installing codex.exe and native apply_patch.exe" [IO.Directory]::CreateDirectory($pathDirectory) | Out-Null Copy-FileReplacing $codexSource $codexTarget Copy-FileReplacing $applyPatchSource $applyPatchTarget if ((Get-Sha256 $codexTarget) -ne $manifest.overlayCodexSha256 -or (Get-Sha256 $applyPatchTarget) -ne $manifest.overlayApplyPatchSha256) { throw "Installed binary checksum verification failed." } $versionOutput = (& $codexTarget --version 2>&1 | Out-String).Trim() if ($LASTEXITCODE -ne 0) { throw "The…

High

Ai Review Evidence

The installer replaces that executable and its apply_patch helper with package-supplied binaries, then runs the replacement.

install.ps1View on unpkg · L215

Source & flagged code

9 flagged

package.jsonView file

Lines 21-48json

21 ],

22 "engines": {

23 "node": ">=16"

24 },

25 "bin": {

26 "codex-win-patch-install": "bin/install.js",

27 "codex-win-patch-restore": "bin/restore.js"

28 },

29 "files": [

30 "bin",

31 "apply_patch.exe",

32 "build-info.json",

33 "codex.exe",

34 "docs",

35 "install.ps1",

36 "LICENSE",

37 "README.md",

38 "restore.ps1",

39 "SHA256SUMS"

40 ],

41 "scripts": {

42 "postinstall": "node bin/install.js --postinstall"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

High

Suspicious Lifecycle Evidence

The package automatically runs its installer in postinstall.

package.jsonView on unpkg · L41

44 "publishConfig": {

45 "access": "public",

46 "registry": "https://registry.npmjs.org/"

47 }

48}

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 307329536 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

bin/powershell.jsView file

Lines 2-42javascript

2const path = require("node:path");

3

4function powershellCandidates() {

5 const configured = process.env.CODEX_WINDOWS_PATCH_POWERSHELL;

install.ps1View file

Lines 71-111text

71 if (-not [string]::IsNullOrWhiteSpace($NpmRoot)) {

72 if (-not (Test-Path -LiteralPath $NpmRoot -PathType Container)) {

73 throw "The npm root does not exist: $NpmRoot"

74 }

75 return (Resolve-Path -LiteralPath $NpmRoot).Path

76 }

77

78 $detectedRoot = (& npm root -g 2>&1 | Out-String).Trim()

79 if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($detectedRoot)) {

80 throw "Could not locate the global npm root. Install npm or pass -NpmRoot explicitly."

81 }

82 if (-not (Test-Path -LiteralPath $detectedRoot -PathType Container)) {

Lines 195-235text

195

196$manifest = [ordered]@{

197 schemaVersion = 1

198 createdAtUtc = [DateTime]::UtcNow.ToString("o")

199 npmRoot = $globalNpmRoot

200 packageDirectory = $packageDirectory

201 codexPath = $codexTarget

202 applyPatchPath = $applyPatchTarget

203 codexBackup = "codex.exe"

204 applyPatchExisted = $applyPatchExisted

205 applyPatchBackup = if ($applyPatchExisted) { "apply_patch.exe" } else { $null }

206 originalCodexSha256 = Get-Sha256 $codexTarget

207 originalApplyPatchSha256 = if ($applyPatchExisted) { Get-Sha256 $applyPatchTarget } else { $null }

208 overlayCodexSha256 = Get-Sha256 $codexSource

209 overlayApplyPatchSha256 = Get-Sha256 $applyPatchSource

210}

211$manifestPath = Join-Path $backupDirectory "manifest.json"

212$manifestJson = $manifest | ConvertTo-Json

213[IO.File]::WriteAllText($manifestPath, $manifestJson, [Text.UTF8Encoding]::new($false))

214

215try {

216 Write-Step "Installing codex.exe and native apply_patch.exe"

217 [IO.Directory]::CreateDirectory($pathDirectory) | Out-Null

218 Copy-FileReplacing $codexSource $codexTarget

219 Copy-FileReplacing $applyPatchSource $applyPatchTarget

220

221 if ((Get-Sha256 $codexTarget) -ne $manifest.overlayCodexSha256 -or

222 (Get-Sha256 $applyPatchTarget) -ne $manifest.overlayApplyPatchSha256) {

223 throw "Installed binary checksum verification failed."

224 }

225

226 $versionOutput = (& $codexTarget --version 2>&1 | Out-String).Trim()

High

Ai Review Evidence

The installer replaces that executable and its apply_patch helper with package-supplied binaries, then runs the replacement.

install.ps1View on unpkg · L215

227 if ($LASTEXITCODE -ne 0) {

228 throw "The installed codex.exe failed its version check: $versionOutput"

229 }

230} catch {

231 Write-Warning "Installation failed. Restoring the original npm files."

232 Copy-FileReplacing $codexBackup $codexTarget

233 if ($applyPatchExisted) {

234 Copy-FileReplacing $applyPatchBackup $applyPatchTarget

235 } elseif (Test-Path -LiteralPath $applyPatchTarget -PathType Leaf) {