@codex-ultra/cxu@0.2.24: Scan Failed npm security report (Allow) | LPM Firewall

Loading npm security reports…

@codex-ultra/cxu@0.2.24: Scan Failed npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x2b2973,_0x4d66c4){const _0x5bb9de=_0x2b2973();function _0x23afa4(_0x43dabe,_0x2353f4,_0x7368fe,_0x15ddea){return _0x5642(_0x7368fe- -0xaf,_0x43dabe);}function _0x1dfd1... Write operation from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

1(function(_0x2b2973,_0x4d66c4){const _0x5bb9de=_0x2b2973();function _0x23afa4(_0x43dabe,_0x2353f4,_0x7368fe,_0x15ddea){return _0x5642(_0x7368fe- -0xaf,_0x43dabe);}function _0x1dfd1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1(function(_0x2b2973,_0x4d66c4){const _0x5bb9de=_0x2b2973();function _0x23afa4(_0x43dabe,_0x2353f4,_0x7368fe,_0x15ddea){return _0x5642(_0x7368fe- -0xaf,_0x43dabe);}function _0x1dfd1...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/postinstall.jsView file

1import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/postinstall.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @codex-ultra/cxu@0.2.12 matchedPath = dist/postinstall.js matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/postinstall.jsView on unpkg

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-v19efhfs.jsView file

•path = web-dist/assets/main-v19efhfs.js kind = oversized_source_file sizeBytes = 9109807 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-v19efhfs.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 11-51json

11 "import": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cxu": "dist/cli.js"

16 },

17 "files": [

18 "dist",

19 "wasm",

20 "web-dist",

21 "server-bundle",

22 "README.md",

23 "LICENSE"

24 ],

25 "scripts": {

26 "vendor": "node scripts/vendor-sa-vm.mjs",

27 "build": "node scripts/build.mjs",

28 "build:bun": "bun scripts/build.mjs",

29 "obfuscate": "node scripts/obfuscate.mjs",

30 "typecheck": "tsc -p tsconfig.json --noEmit",

31 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepack": "npm run build && npm run obfuscate",

33 "test": "bun test test/ 2>/dev/null || node --test test/*.test.mjs"

34 },

35 "publishConfig": {

36 "access": "public"

37 },

38 "dependencies": {

39 "tree-sitter-wasms": "^0.1.13",

40 "web-tree-sitter": "0.25.10"

41 },

42 "devDependencies": {

43 "esbuild": "^0.25.12",

44 "javascript-obfuscator": "^5.5.0",

45 "typescript": "^5.9.3"

46 },

47 "engines": {

48 "node": ">=18"

49 },

50 "license": "MIT",

51 "homepage": "https://github.com/layola13/codex-ultra#readme",

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x2b2973,_0x4d66c4){const _0x5bb9de=_0x2b2973();function _0x23afa4(_0x43dabe,_0x2353f4,_0x7368fe,_0x15ddea){return _0x5642(_0x7368fe- -0xaf,_0x43dabe);}function _0x1dfd1... Write operation from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

1(function(_0x2b2973,_0x4d66c4){const _0x5bb9de=_0x2b2973();function _0x23afa4(_0x43dabe,_0x2353f4,_0x7368fe,_0x15ddea){return _0x5642(_0x7368fe- -0xaf,_0x43dabe);}function _0x1dfd1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1(function(_0x2b2973,_0x4d66c4){const _0x5bb9de=_0x2b2973();function _0x23afa4(_0x43dabe,_0x2353f4,_0x7368fe,_0x15ddea){return _0x5642(_0x7368fe- -0xaf,_0x43dabe);}function _0x1dfd1...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.js

dist/postinstall.jsView file

Lines 1-2javascript

1import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"node:module"

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-v19efhfs.jsView file

•path = web-dist/assets/main-v19efhfs.js kind = oversized_source_file sizeBytes = 9109807 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-v19efhfs.jsView on unpkg