registry / @codeuxai/codeux / 0.8.7

@codeuxai/codeux@0.8.7

Containerized environment for running and managing AI sub-agents

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky behavior is an explicit local dashboard feature for provider login and Docker-based AI-agent workflows, not install-time or hidden execution.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the codeux CLI and starts provider login or container workflows through the local dashboard/API.

Impact

Can install provider CLIs, run Docker containers, and write local Code UX credential folders when invoked by a local dashboard user.

Mechanism

User-invoked Docker provider login and CLI setup

Rationale

Static source inspection confirms high-risk primitives, but they are user-invoked local dashboard/container features consistent with the package's stated AI sub-agent runtime purpose. I found no lifecycle execution, hidden import-time payload, credential exfiltration, persistence, destructive behavior beyond scoped temp/login cleanup, or unconsented AI-agent control-surface mutation.

Evidence

package.jsondist/index.jsdist/server/terminal-routes.jsdist/server/dashboard-server.jsdist/server/dashboard-middleware.jsdist/server/dashboard-security.jsdist/services/cli-docker-utils.js.code-ux/container/setup.shREADME.md~/.code-ux/credentials/<providerConfigId>~/.code-ux/credentials/<providerConfigId>-temp-<sessionId>

Network endpoints6

jules.googleapis.com/v1alphaclaude.ai/install.shopencode.ai/installantigravity.google/cli/install.shapi.github.comhuggingface.co

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/server/terminal-routes.js exposes user-triggered endpoints that spawn docker containers and proxy terminal I/O.
dist/server/terminal-routes.js copies login credentials from a temp container mount into ~/.code-ux/credentials/<providerConfigId>.
dist/services/cli-docker-utils.js and .code-ux/container/setup.sh install provider CLIs via npm or curl scripts.

Evidence against

package.json has no install/postinstall lifecycle hook; bin/main is dist/index.js only.
dist/index.js starts an explicit CLI/dashboard server, loads config, and does not run terminal login flows at import/install time.
dist/server/dashboard-server.js binds dashboard to 127.0.0.1 by default; dashboard-middleware.js blocks hostile cross-site mutation origins.
dist/server/terminal-routes.js validates providerId against a fixed allowlist and providerConfigId with assertSafePathSegment before filesystem writes.
Docker/child_process/network behavior aligns with README.md purpose: containerized management of AI sub-agents and provider CLI login.
No credential harvesting or exfiltration endpoint found; credentials are copied locally under ~/.code-ux/credentials for selected providers.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 551 file(s), 9.35 MB of source, external domains: 127.0.0.1, antigravity.google, api.github.com, api.openai.com, belcour.github.io, blog.selfshadow.com, bugzilla.mozilla.org, byteblacksmith.com, casual-effects.com, cdn.jsdelivr.net, cdn2.unrealengine.com, claude.ai, code.google.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, company.atlassian.net, dashscope.aliyuncs.com, developer.mozilla.org, developers.google.com, drafts.csswg.org, dummy.com, en.wikipedia.org, example.com, filmicworlds.com, github.com, gitlab.com, google.github.io, googlechrome.github.io, graphicrants.blogspot.com, graphics.stanford.edu, gsap.com, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, huggingface.co, iolite-engine.com, jcgt.org, jules.googleapis.com, mmikk.github.io, models.dev, modelviewer.dev, opencode.ai, r12a.github.io, react-dnd.github.io, reactjs.org, redux.js.org, sass-lang.com, schema.org, seblagarde.files.wordpress.com, stackoverflow.com

Oversized source lightweight scan

dashboard/dist/assets/editor.api2-KGjWAjnM.js3.46 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

dashboard/dist/assets/ts.worker-B0J26iPs.js6.58 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

9 flagged

dist/server/terminal-routes.jsView file

Lines 1-21javascript

1import { spawn } from "child_process";

2import * as fs from "fs/promises";

High

Child Process

Package source references child process execution.

dist/server/terminal-routes.jsView on unpkg · L1

3import * as os from "os";

4import * as path from "path";

5import { createHash, randomUUID } from "crypto";

6import { isHostileBrowserOrigin } from "./dashboard-security.js";

7import * as net from "net";

8import { asyncRoute, syncRoute, toErrorResponse } from "./route-utils.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/terminal-routes.jsView on unpkg · L1

9import { ENSURE_CURL_SHELL_FUNCTION, getDockerUserSpec, getProviderFallbackInstallCommand } from "../services/cli-docker-utils.js";

10import { assertSafePathSegment } from "../utils/path-validator.js";

11async function getFreePort() {

12 return new Promise((resolve, reject) => {

13 const server = net.createServer();

14 server.listen(0, "127.0.0.1", () => {

15 const addr = server.address();

16 const port = typeof addr === "object" && addr !== null ? addr.port : 0;

17 server.close(() => {

18 resolve(port);

19 });

20 });

21 server.on("error", (err) => {

Lines 244-284javascript

244 session.lastDisconnectAt = now;

245 }

246 }

247 if (shouldExpireByAge || shouldExpireByHeartbeat) {

248 terminateSession(id, shouldExpireByAge ? "max-age" : "stale-heartbeat");

249 }

250 }

251 }, LOGIN_SESSION_SWEEP_INTERVAL_MS);

252

Lines 466-506javascript

466 "ln -sf /tmp/.credentials /tmp/.qwen",

467 "ln -sf /tmp/.credentials /tmp/.local/share/opencode",

468 "ln -sf /tmp/.credentials /tmp/.antigravity",

469 providerId === "antigravity" ? "ln -sf /tmp/.credentials /tmp/.local/share/keyrings" : "",

470 providerId === "antigravity" ? [

471 "if ! command -v dbus-daemon >/dev/null 2>&1 || ! command -v gnome-keyring-daemon >/dev/null 2>&1; then"

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/server/code-ux-server.js -> dist/app/lifecycle/dashboard-lifecycle-service.js -> dist/server/dashboard-server.js -> dist/server/terminal-routes.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/terminal-routes.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @codeuxai/codeux@0.8.6 matchedIdentity = npm:QGNvZGV1eGFpL2NvZGV1eA:0.8.6 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/server/terminal-routes.jsView on unpkg

.code-ux/container/setup.shView file

•path = .code-ux/container/setup.sh kind = payload_in_excluded_dir sizeBytes = 6493 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.code-ux/container/setup.shView on unpkg

•path = .code-ux/container/setup.sh kind = build_helper sizeBytes = 6493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.code-ux/container/setup.shView on unpkg

dashboard/dist/assets/editor.api2-KGjWAjnM.jsView file

•path = dashboard/dist/assets/editor.api2-KGjWAjnM.js kind = oversized_source_file sizeBytes = 3626875 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dashboard/dist/assets/editor.api2-KGjWAjnM.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/server/terminal-routes.jsView file

486"mkdir -p /tmp/.npm-global", L487: "export NPM_CONFIG_PREFIX=/tmp/.npm-global", L488: "export PATH=/tmp/.npm-global/bin:$PATH", ... L493: "const fs = require('fs');", L494: "const { spawn } = require('child_process');", L495: "const args = process.argv.slice(2);", L496: "console.log('[DEBUG] xdg-open called with args:', args);", L497: "let url = args.find(arg => arg.startsWith('http://') || arg.startsWith('https://'));", L498: "if (url) {",

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/server/terminal-routes.jsView on unpkg · L486

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/terminal-routes.jsView on unpkg

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/server/terminal-routes.jsView on unpkg

1import { spawn } from "child_process"; L2: import * as fs from "fs/promises";

High

Child Process

Package source references child process execution.

dist/server/terminal-routes.jsView on unpkg · L1

264try { L265: const cp = await import("child_process"); L266: if (!cp || typeof cp.exec !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/terminal-routes.jsView on unpkg · L264

1import { spawn } from "child_process"; L2: import * as fs from "fs/promises"; ... L6: import { isHostileBrowserOrigin } from "./dashboard-security.js"; L7: import * as net from "net"; L8: import { asyncRoute, syncRoute, toErrorResponse } from "./route-utils.js"; ... L47: function encodeFrame(payload) { L48: const message = Buffer.from(payload, "utf8"); L49: const length = message.length; ... L67: try { L68: socket.write(encodeFrame(JSON.stringify(payload))); L69: } ... L269: await new Promise((resolve) => {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/terminal-routes.jsView on unpkg · L1

.code-ux/container/setup.shView file

•path = .code-ux/container/setup.sh kind = payload_in_excluded_dir sizeBytes = 6493 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.code-ux/container/setup.shView on unpkg

•path = .code-ux/container/setup.sh kind = build_helper sizeBytes = 6493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.code-ux/container/setup.shView on unpkg

dashboard/dist/assets/editor.api2-KGjWAjnM.jsView file

•path = dashboard/dist/assets/editor.api2-KGjWAjnM.js kind = oversized_source_file sizeBytes = 3626875 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dashboard/dist/assets/editor.api2-KGjWAjnM.jsView on unpkg

Findings

3 Critical4 High5 Medium7 Low

CriticalSame File Env Network Executiondist/server/terminal-routes.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/terminal-routes.js

CriticalPrevious Version Dangerous Deltadist/server/terminal-routes.js

HighChild Processdist/server/terminal-routes.js

HighShell

HighPayload In Excluded Dir.code-ux/container/setup.sh

HighOversized Source Filedashboard/dist/assets/editor.api2-KGjWAjnM.js

MediumDynamic Requiredist/server/terminal-routes.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.code-ux/container/setup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/server/terminal-routes.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

9 flagged

dist/server/terminal-routes.jsView file

Lines 1-21javascript

1import { spawn } from "child_process";

2import * as fs from "fs/promises";

High

Child Process

Package source references child process execution.

dist/server/terminal-routes.jsView on unpkg · L1

3import * as os from "os";

4import * as path from "path";

5import { createHash, randomUUID } from "crypto";

6import { isHostileBrowserOrigin } from "./dashboard-security.js";

7import * as net from "net";

8import { asyncRoute, syncRoute, toErrorResponse } from "./route-utils.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/terminal-routes.jsView on unpkg · L1

9import { ENSURE_CURL_SHELL_FUNCTION, getDockerUserSpec, getProviderFallbackInstallCommand } from "../services/cli-docker-utils.js";

10import { assertSafePathSegment } from "../utils/path-validator.js";

11async function getFreePort() {

12 return new Promise((resolve, reject) => {

13 const server = net.createServer();

14 server.listen(0, "127.0.0.1", () => {

15 const addr = server.address();

16 const port = typeof addr === "object" && addr !== null ? addr.port : 0;

17 server.close(() => {

18 resolve(port);

19 });

20 });

21 server.on("error", (err) => {

Lines 244-284javascript

244 session.lastDisconnectAt = now;

245 }

246 }

247 if (shouldExpireByAge || shouldExpireByHeartbeat) {

248 terminateSession(id, shouldExpireByAge ? "max-age" : "stale-heartbeat");

249 }

250 }

251 }, LOGIN_SESSION_SWEEP_INTERVAL_MS);

252

Lines 466-506javascript

466 "ln -sf /tmp/.credentials /tmp/.qwen",

467 "ln -sf /tmp/.credentials /tmp/.local/share/opencode",

468 "ln -sf /tmp/.credentials /tmp/.antigravity",

469 providerId === "antigravity" ? "ln -sf /tmp/.credentials /tmp/.local/share/keyrings" : "",

470 providerId === "antigravity" ? [

471 "if ! command -v dbus-daemon >/dev/null 2>&1 || ! command -v gnome-keyring-daemon >/dev/null 2>&1; then"

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/terminal-routes.jsView on unpkg

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/server/terminal-routes.jsView on unpkg

.code-ux/container/setup.shView file

•path = .code-ux/container/setup.sh kind = payload_in_excluded_dir sizeBytes = 6493 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.code-ux/container/setup.shView on unpkg

•path = .code-ux/container/setup.sh kind = build_helper sizeBytes = 6493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.code-ux/container/setup.shView on unpkg

dashboard/dist/assets/editor.api2-KGjWAjnM.jsView file

•path = dashboard/dist/assets/editor.api2-KGjWAjnM.js kind = oversized_source_file sizeBytes = 3626875 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dashboard/dist/assets/editor.api2-KGjWAjnM.jsView on unpkg