registry / @codex-ultra/cxu / 0.2.6

@codex-ultra/cxu@0.2.6

codex-ultra workbench launcher: prebuilt server + web UI for every platform (cxu starts it all).

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The user-invoked CLI and import entry point load heavily obfuscated code that includes file and process primitives. No install-time execution or confirmed hostile endpoint was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Importing dist/index.js or running the cxu command.

Impact

The concealed implementation cannot be safely validated; its runtime capabilities could affect local files or processes.

Mechanism

Obfuscated runtime with file and process capabilities.

AI rationale

The package deliberately obfuscates its published runtime but has no registry install lifecycle hook or self-dependency chain. Static inspection did not establish a concrete malicious action, so blocking is not justified.

Evidence

dist/index.jsdist/cli.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The published main module is deliberately obfuscated, preventing reliable static validation of its file, process, and network behavior.
The manifest intentionally runs an obfuscation step before packing the release.

@codex-ultra/cxu@0.2.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code