Loading npm security reports…

@chenronggui/codex-win-patch@0.155.1-patch.2: AI-agent | LPM Firewall

registry / @chenronggui/codex-win-patch / 0.155.1-patch.2

@chenronggui/codex-win-patch@0.155.1-patch.2

面向 OpenAI Codex CLI 的非官方 Windows x64 补丁。

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm installation automatically replaces executables inside an existing @openai Codex installation. This mutates a foreign AI-agent command surface with opaque bundled binaries.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install -g invokes postinstall.

Impact

Subsequent Codex and apply_patch executions run package-supplied binaries instead of the original installed files.

Mechanism

PowerShell copies bundled executables over @openai Codex binaries.

Policy narrative

Installing this package globally triggers its postinstall launcher. The launcher runs install.ps1, which searches the global npm tree for @openai Codex and copies the package's bundled codex.exe and apply_patch.exe over the trusted installation. Backups do not make the automatic replacement consented or constrain what the replacement binaries can do.

AI rationale

This is an unconsented postinstall mutation of a foreign AI-agent executable surface. The package transparently performs the replacement, but it supplies opaque native payloads that take over later Codex execution.

Evidence

package.jsonbin/install.jsinstall.ps1@openai/codex/vendor/x86_64-pc-windows-msvc/bin/codex.exe@openai/codex/vendor/x86_64-pc-windows-msvc/codex-path/apply_patch.execodex.exeapply_patch.exe

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

41"scripts": { "postinstall": "node bin/install.js --postinstall" }

High

Suspicious Lifecycle Evidence

The install lifecycle automatically runs the installer.

package.jsonView on unpkg · L41

•scripts.postinstall = node bin/install.js --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 307470336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

bin/powershell.jsView file

•matchType = malicious_source_fingerprint_signature signature = bde713c797513693 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @chenronggui/codex-win-patch@0.155.1-patch.1 matchedPath = bin/powershell.js matchedIdentity = npm:[redacted]:0.155.1-patch.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/powershell.jsView on unpkg

bin/install.jsView file

5const args = process.argv.slice(2); const postinstallIndex = args.indexOf("--postinstall"); if (postinstallIndex !== -1) { args.splice(postinstallIndex, 1); const globalInstall = process.env.npm[redacted]; if (globalInstall !== "true" && globalInstall !== "1") { console.error( "@chenronggui/codex-win-patch must be installed globally with npm install -g.", ); process.exit(1); } } process.exit(runPowerShell("install.ps1", args));

High

Suspicious Lifecycle Evidence

The Node launcher accepts the postinstall invocation and runs PowerShell.

bin/install.jsView on unpkg · L5

install.ps1View file

91$candidates = @( (Join-Path $GlobalNpmRoot "@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\node_modules\@openai\$PlatformPackageName\vendor\$TargetTriple"), (Join-Path $GlobalNpmRoot "@openai\codex\vendor\$TargetTriple") ) foreach ($candidate in $candidates) { $manifest = Join-Path $candidate "codex-package.json" $entrypoint = Join-Path $candidate "bin\codex.exe" if ((Test-Path -LiteralPath $manifest -PathType Leaf) -and (Test-Path -LiteralPath $entrypoint -PathType Le…

High

Ai Review Evidence

The installer locates the separately installed @openai Codex platform package.

install.ps1View on unpkg · L91

215try { Write-Step "Installing codex.exe and native apply_patch.exe" [IO.Directory]::CreateDirectory($pathDirectory) | Out-Null Copy-FileReplacing $codexSource $codexTarget Copy-FileReplacing $applyPatchSource $applyPatchTarget

High

Ai Review Evidence

The installer replaces that package's codex.exe and apply_patch.exe with bundled executables.

install.ps1View on unpkg · L215

Source & flagged code

9 flagged

package.jsonView file

Lines 21-48json

21 ],

22 "engines": {

23 "node": ">=16"

24 },

25 "bin": {

26 "codex-win-patch-install": "bin/install.js",

27 "codex-win-patch-restore": "bin/restore.js"

28 },

29 "files": [

30 "bin",

31 "apply_patch.exe",

32 "build-info.json",

33 "codex.exe",

34 "docs",

35 "install.ps1",

36 "LICENSE",

37 "README.md",

38 "restore.ps1",

39 "SHA256SUMS"

40 ],

41 "scripts": {

42 "postinstall": "node bin/install.js --postinstall"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

High

Suspicious Lifecycle Evidence

The install lifecycle automatically runs the installer.

package.jsonView on unpkg · L41

44 "publishConfig": {

45 "access": "public",

46 "registry": "https://registry.npmjs.org/"

47 }

48}

codex.exeView file

•path = codex.exe kind = native_binary sizeBytes = 307470336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codex.exeView on unpkg

restore.ps1View file

•path = restore.ps1 kind = build_helper sizeBytes = 4792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

restore.ps1View on unpkg

bin/powershell.jsView file

•matchType = malicious_source_fingerprint_signature signature = bde713c797513693 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @chenronggui/codex-win-patch@0.155.1-patch.1 matchedPath = bin/powershell.js matchedIdentity = npm:[redacted]:0.155.1-patch.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/powershell.jsView on unpkg

bin/install.jsView file

Lines 1-19javascript

1#!/usr/bin/env node

2

3const { runPowerShell } = require("./powershell.js");

4

5const args = process.argv.slice(2);

6

install.ps1View file

Lines 71-111text

71 if (-not [string]::IsNullOrWhiteSpace($NpmRoot)) {

72 if (-not (Test-Path -LiteralPath $NpmRoot -PathType Container)) {

73 throw "The npm root does not exist: $NpmRoot"

74 }

75 return (Resolve-Path -LiteralPath $NpmRoot).Path

76 }

77

78 $detectedRoot = (& npm root -g 2>&1 | Out-String).Trim()

79 if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($detectedRoot)) {

80 throw "Could not locate the global npm root. Install npm or pass -NpmRoot explicitly."

81 }

82 if (-not (Test-Path -LiteralPath $detectedRoot -PathType Container)) {

Lines 195-235text

195

196$manifest = [ordered]@{

197 schemaVersion = 1

198 createdAtUtc = [DateTime]::UtcNow.ToString("o")

199 npmRoot = $globalNpmRoot

200 packageDirectory = $packageDirectory

201 codexPath = $codexTarget

202 applyPatchPath = $applyPatchTarget

203 codexBackup = "codex.exe"

204 applyPatchExisted = $applyPatchExisted

205 applyPatchBackup = if ($applyPatchExisted) { "apply_patch.exe" } else { $null }

206 originalCodexSha256 = Get-Sha256 $codexTarget

207 originalApplyPatchSha256 = if ($applyPatchExisted) { Get-Sha256 $applyPatchTarget } else { $null }

208 overlayCodexSha256 = Get-Sha256 $codexSource

209 overlayApplyPatchSha256 = Get-Sha256 $applyPatchSource

210}

211$manifestPath = Join-Path $backupDirectory "manifest.json"

212$manifestJson = $manifest | ConvertTo-Json

213[IO.File]::WriteAllText($manifestPath, $manifestJson, [Text.UTF8Encoding]::new($false))

214

215try {

216 Write-Step "Installing codex.exe and native apply_patch.exe"

217 [IO.Directory]::CreateDirectory($pathDirectory) | Out-Null

218 Copy-FileReplacing $codexSource $codexTarget

219 Copy-FileReplacing $applyPatchSource $applyPatchTarget

220

High

Ai Review Evidence

The installer replaces that package's codex.exe and apply_patch.exe with bundled executables.

install.ps1View on unpkg · L215

221 if ((Get-Sha256 $codexTarget) -ne $manifest.overlayCodexSha256 -or

222 (Get-Sha256 $applyPatchTarget) -ne $manifest.overlayApplyPatchSha256) {

223 throw "Installed binary checksum verification failed."

224 }

225

226 $versionOutput = (& $codexTarget --version 2>&1 | Out-String).Trim()

227 if ($LASTEXITCODE -ne 0) {

228 throw "The installed codex.exe failed its version check: $versionOutput"

229 }

230} catch {

231 Write-Warning "Installation failed. Restoring the original npm files."

232 Copy-FileReplacing $codexBackup $codexTarget

233 if ($applyPatchExisted) {

234 Copy-FileReplacing $applyPatchBackup $applyPatchTarget

235 } elseif (Test-Path -LiteralPath $applyPatchTarget -PathType Leaf) {