registry / @codex-ultra/cxu / 0.2.7

@codex-ultra/cxu@0.2.7

codex-ultra workbench launcher: prebuilt server + web UI for every platform (cxu starts it all).

AI Security Review

scanned 25d ago · by lpm-firewall-ai

No automatic install-time attack was confirmed. On explicit CLI use, the obfuscated launcher can start a bundled platform executable and the library contains broad file, process, and HTTP primitives.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs cxu or imports and calls its library APIs.

Impact

The opaque implementation makes the scope of runtime file, process, and network actions difficult to independently verify.

Mechanism

Obfuscated launcher and agent-style file/process/HTTP capability bundle.

AI rationale

No concrete malicious install-time behavior or exfiltration was established, so a block is not justified. The intentionally opaque implementation combined with broad agent-like capabilities is a real unresolved supply-chain risk.

Evidence

package.jsondist/index.jsdist/cli.js

Decision evidence

public snapshot

AI called this Suspicious at 73.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Published JavaScript is heavily obfuscated, including a runtime string decoder, which prevents reliable review of its broad file, process, and HTTP capabilities.

@codex-ultra/cxu@0.2.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code