Loading npm security reports…

@codex-ultra/cxu@0.2.12: Malicious npm security report (Block) | LPM Firewall

registry / @codex-ultra/cxu / 0.2.12

@codex-ultra/cxu@0.2.12

codex-ultra workbench launcher: server compiled locally with Bun + web UI (cxu starts it all).

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Installing the package automatically runs code that builds a persistent standalone server in the user's home directory. That server bundle includes embedded AI-agent control text, while the CLI is obfuscated.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation activates postinstall; running cxu activates the installed launcher and server.

Impact

The package can establish a persistent local agent launcher and influence AI-agent behavior without an explicit setup command.

Mechanism

Automatic local server installation with obfuscated agent-launch code and embedded agent instructions.

Attack narrative

npm invokes dist/postinstall.js automatically. The inspected installer creates a versioned standalone server in the user's home directory, and the package ships an obfuscated CLI that launches it. The compiled server bundle embeds imperative text directed at an AI agent to restrict its actions. Together, automatic persistence, opaque launcher behavior, and agent-control content form a concrete install-time abuse chain.

AI rationale

This is not transparent package-aligned setup: automatic installation creates a persistent launcher and ships obfuscated code containing AI-agent control instructions. The embedded agent-directed text is social engineering evidence and makes the lifecycle chain malicious.

Evidence

package.jsonserver-bundle/index.jsdist/postinstall.jsdist/cli.js.cxu/server/v<version>/codex-standalone

Network endpoints1

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server-bundle/index.jsView file

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`: L4: ${Zu(h)}`:""}`))},Jh);d.stdout.on("data",h=>{l+=h.toString("utf8")}),d.stderr.on("data",h=>{c+=h.toString("utf8")}),d.once("exit",h=>{if(!p)if(p=!0,clearTimeout(m),h===0||this.hasU... L5: `);a(new Error(`Failed to ${r} daemon (code ${h}): ${Zu(u)}`))}}),d.once("error",h=>{p||(p=!0,clearTimeout(m),a(h))})})}daemonNeedsRuntimeEnvRestart(n){

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

server-bundle/index.jsView on unpkg · L1

2649${c}`)}}));let r=await R.loadWebAssemblyModule(await n,{loadAsync:!0}),s=Object.keys(r),o=s.find(d=>rM.test(d)&&!d.includes("external_scanner_"));if(!o)throw console.log(`Couldn't ... L2650: ${JSON.stringify(s,null,2)}`),new Error("Language.load failed: no language function found in WASM file");let a=r[o]();return new xb(Br,a)}},sM=(()=>{var _scriptName=import.meta.url... L2651: `);function s(o,a){for(let d=0;d<o.length;d++){let l=o[d];if(!l)continue;let c=d===o.length-1,p=c?"\u2514\u2500\u2500 ":"\u251C\u2500\u2500 ",m=a+(c?" ":"\u2502 "),h=`[L${l.st...

High

Eval

Package source references dynamic code evaluation.

server-bundle/index.jsView on unpkg · L2649

•command output transform/external POST = de(r,"foreground");if(!l)throw d.stop(),t.delete(r),new error("autonomous remote thread route disappeared during attach");return{threadid:r,state:"foreground",remotecontinues:!0,route:l,status:d.getstatus()}}t.get(r)?.stop(),t.delete(r);let a=e.setlifecyclemode(r,"background");if(!a)throw new error("autonomous remote thread route disappeared during detach");return{threadid:r,state:"background",remotecontinues:!0,route:a}}import{eventemitter as ea}from"node:events";import{createreadstream as cs,existssync as ss}from"node:fs";import{createserver as as}from"node:net";import{arch as rs,platform as ps}from"node:os";import{dirname as ms,resolve as jp}from"node:path";import{fileurltopath as os}from"node:url";import{execfile as ns,spawn as gp}from"node:chil

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

server-bundle/index.jsView on unpkg

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... ... L649: `,p+"/release-id","600");let m=GS({releaseId:a,port:n,token:l,home:r.home,claudeEnabled:o!=="disabled"}),h=["[Unit]","Description=Codex Ultra Remote Bun Server","After=network-onli... L650: `);await Bp(t,m,"~/.codex-ultra/remote/server.env","600"),await Bp(t,h,"~/.config/systemd/user/"+fi,"600"),await Pr("ssh",[...t,'rm -rf "$HOME/.codex-ultra/remote/previous"; rm -f ... L651: `)+` ... L2649: ${c}`)}}));let r=a

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

server-bundle/index.jsView on unpkg · L1

1Cross-file remote execution chain: server-bundle/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`: L4: ${Zu(h)}`:""}`))},Jh);d.stdout.on("data",h=>{l+=h.toString("utf8")}),d.stderr.on("data",h=>{c+=h.toString("utf8")}),d.once("exit",h=>{if(!p)if(p=!0,clearTimeout(m),h===0||this.hasU... L5: `);a(new Err

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server-bundle/index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @codex-ultra/cxu@0.2.9 matchedPath = server-bundle/index.js matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server-bundle/index.jsView on unpkg

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`: L4: ${Zu(h)}`:""}`))},Jh);d.stdout.on("data",h=>{l+=h.toString("utf8")}),d.stderr.on("data",h=>{c+=h.toString("utf8")}),d.once("exit",h=>{if(!p)if(p=!0,clearTimeout(m),h===0||this.hasU... L5: `);a(new Error(`Failed to ${r} daemon (code ${h}): ${Zu(u)}`))}}),d.once("error",h=>{p||(p=!0,clearTimeout(m),a(h))})})}daemonNeedsRuntimeEnvRestart(n){

Low

Weak Crypto

Package source references weak cryptographic algorithms.

server-bundle/index.jsView on unpkg · L1

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x3eeb3a,_0x4b807d){function _0x1059b3(_0x1cc6ee,_0x4b1f69,_0x3dea34,_0x543a42){return _0x2ad2(_0x1cc6ee- -0x30e,_0x4b1f69);}const _0xfade7c=_0x3eeb3a();function _0x4d08... Write operation from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @codex-ultra/cxu@0.2.11 matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.11 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1(function(_0x3eeb3a,_0x4b807d){function _0x1059b3(_0x1cc6ee,_0x4b1f69,_0x3dea34,_0x543a42){return _0x2ad2(_0x1cc6ee- -0x30e,_0x4b1f69);}const _0xfade7c=_0x3eeb3a();function _0x4d08...

High

dist/postinstall.jsView file

1import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/postinstall.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @codex-ultra/cxu@0.2.9 matchedPath = dist/postinstall.js matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/postinstall.jsView on unpkg

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-4g10184v.jsView file

•path = web-dist/assets/main-4g10184v.js kind = oversized_source_file sizeBytes = 9078854 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-4g10184v.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 11-51json

11 "import": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cxu": "dist/cli.js"

16 },

17 "files": [

18 "dist",

19 "wasm",

20 "web-dist",

21 "server-bundle",

22 "README.md",

23 "LICENSE"

24 ],

25 "scripts": {

26 "vendor": "node scripts/vendor-sa-vm.mjs",

27 "build": "node scripts/build.mjs",

28 "build:bun": "bun scripts/build.mjs",

29 "obfuscate": "node scripts/obfuscate.mjs",

30 "typecheck": "tsc -p tsconfig.json --noEmit",

31 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepack": "npm run build && npm run obfuscate",

33 "test": "bun test test/ 2>/dev/null || node --test test/*.test.mjs"

34 },

35 "publishConfig": {

36 "access": "public"

37 },

38 "dependencies": {

39 "tree-sitter-wasms": "^0.1.13",

40 "web-tree-sitter": "0.25.10"

41 },

42 "devDependencies": {

43 "esbuild": "^0.25.12",

44 "javascript-obfuscator": "^5.5.0",

45 "typescript": "^5.9.3"

46 },

47 "engines": {

48 "node": ">=18"

49 },

50 "license": "MIT",

51 "homepage": "https://github.com/layola13/codex-ultra#readme",

server-bundle/index.jsView file

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`: L4: ${Zu(h)}`:""}`))},Jh);d.stdout.on("data",h=>{l+=h.toString("utf8")}),d.stderr.on("data",h=>{c+=h.toString("utf8")}),d.once("exit",h=>{if(!p)if(p=!0,clearTimeout(m),h===0||this.hasU... L5: `);a(new Error(`Failed to ${r} daemon (code ${h}): ${Zu(u)}`))}}),d.once("error",h=>{p||(p=!0,clearTimeout(m),a(h))})})}daemonNeedsRuntimeEnvRestart(n){

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

server-bundle/index.jsView on unpkg · L1

2649${c}`)}}));let r=await R.loadWebAssemblyModule(await n,{loadAsync:!0}),s=Object.keys(r),o=s.find(d=>rM.test(d)&&!d.includes("external_scanner_"));if(!o)throw console.log(`Couldn't ... L2650: ${JSON.stringify(s,null,2)}`),new Error("Language.load failed: no language function found in WASM file");let a=r[o]();return new xb(Br,a)}},sM=(()=>{var _scriptName=import.meta.url... L2651: `);function s(o,a){for(let d=0;d<o.length;d++){let l=o[d];if(!l)continue;let c=d===o.length-1,p=c?"\u2514\u2500\u2500 ":"\u251C\u2500\u2500 ",m=a+(c?" ":"\u2502 "),h=`[L${l.st...

High

Eval

Package source references dynamic code evaluation.

server-bundle/index.jsView on unpkg · L2649

•command output transform/external POST = de(r,"foreground");if(!l)throw d.stop(),t.delete(r),new error("autonomous remote thread route disappeared during attach");return{threadid:r,state:"foreground",remotecontinues:!0,route:l,status:d.getstatus()}}t.get(r)?.stop(),t.delete(r);let a=e.setlifecyclemode(r,"background");if(!a)throw new error("autonomous remote thread route disappeared during detach");return{threadid:r,state:"background",remotecontinues:!0,route:a}}import{eventemitter as ea}from"node:events";import{createreadstream as cs,existssync as ss}from"node:fs";import{createserver as as}from"node:net";import{arch as rs,platform as ps}from"node:os";import{dirname as ms,resolve as jp}from"node:path";import{fileurltopath as os}from"node:url";import{execfile as ns,spawn as gp}from"node:chil

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x3eeb3a,_0x4b807d){function _0x1059b3(_0x1cc6ee,_0x4b1f69,_0x3dea34,_0x543a42){return _0x2ad2(_0x1cc6ee- -0x30e,_0x4b1f69);}const _0xfade7c=_0x3eeb3a();function _0x4d08... Write operation from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @codex-ultra/cxu@0.2.11 matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.11 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1(function(_0x3eeb3a,_0x4b807d){function _0x1059b3(_0x1cc6ee,_0x4b1f69,_0x3dea34,_0x543a42){return _0x2ad2(_0x1cc6ee- -0x30e,_0x4b1f69);}const _0xfade7c=_0x3eeb3a();function _0x4d08...

High

dist/postinstall.jsView file

Lines 1-2javascript

1import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"node:module"

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-4g10184v.jsView file

•path = web-dist/assets/main-4g10184v.js kind = oversized_source_file sizeBytes = 9078854 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-4g10184v.jsView on unpkg