registry / @cluic/codex-remote-proxy / 0.3.0

@cluic/codex-remote-proxy@0.3.0

Local supervisor and Web UI for routing Codex through OpenAI-compatible providers while preserving ChatGPT sign-in

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `crp start` or invokes provider/setup actions through the local management UI.

Impact

The package can redirect Codex traffic and configured credentials to an operator-selected upstream; optional capture retains traffic locally.

Mechanism

Explicit Codex proxy configuration plus local request forwarding.

Rationale

The package is not source-confirmed malicious, but its explicit user-command Codex configuration mutation and traffic-routing capability warrant a warning under the agent-control policy. No publish-block condition is met.

Evidence

package.jsonbin/crp.mjssrc/server.mjssrc/codex/codex-config.mjssrc/capture-store.mjssrc/supervisor/supervisor-client.mjs~/.codex/config.tomlsrc/supervisor/supervisor-entry.mjssrc/worker/worker-entry.mjs

Network endpoints2

127.0.0.1:15100127.0.0.1:15101

@cluic/codex-remote-proxy@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code