Loading npm security reports…

@codex-ultra/cxu@0.2.79: Suspicious npm security report (Warn) | LPM Firewall

registry / @codex-ultra/cxu / 0.2.79

@codex-ultra/cxu@0.2.79

codex-ultra workbench launcher: server compiled locally with Bun + web UI (cxu starts it all).

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No concrete attack was identified. The flagged agent locations implement executable discovery and workspace workflow storage.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installation prepares the local server cache; explicit CLI use activates the workbench and optional installers.

Impact

Inspected source establishes no credential theft, unconsented agent control changes, or malicious persistence.

Mechanism

Local compilation, package cache writes, consent-gated tool installation, terminal execution, and parser loading support the package functionality.

AI rationale

The inspected lifecycle and required source paths show package-aligned preparation and caller-activated capabilities. Tracing both flagged agent locations found no concrete malicious behavior or unresolved control-surface mutation.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Evidence for AI clean decision

package.json runs a local postinstall script and has no runtime self-dependency.

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codex-ultra/cxu@0.2.73 matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.73 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/postinstall.jsView on unpkg

1import{spawnSync as j}from"node:child_process";import{chmodSync as P,copyFileSync as f,cpSync as v,existsSync as s,mkdirSync as a,readdirSync as V,readFileSync as E,rmSync as g,sta...

High

Child Process

Package source references child process execution.

dist/postinstall.jsView on unpkg · L1

1import{spawnSync as j}from"node:child_process";import{chmodSync as P,copyFileSync as f,cpSync as v,existsSync as s,mkdirSync as a,readdirSync as V,readFileSync as E,rmSync as g,sta...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/postinstall.jsView on unpkg · L1

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L27: `;function vn(kr,ir){an[kr]+=ir}}function ke(K){switch(K){case 3:return"│";case 12:return"─";case 5:return"╯";case 9:return"╰";case 6:return"╮";case 10:return"╭";case 7:return"┤";c... L28: (original error: ${be.message||be})`)}if(s=re,o.length=0,c===void 0)c=fi(Q,"legend.json");if(!t.existsSync(Q))t.mkdirSync(Q,{recursive:!0});let _e=s==="build"?`.${process.pid}-${++... L29: `+[{name:"process_name",args:{name:"tsc"},...he},{name:"thread_name",args:{name:"Main"},...he},{name:"TracingStartedInBrowser",...he,cat:"disabled-by-default-devtools.timeline"}].m... ... L34: `)}t.writeSync(le,`] L35: `),t.closeSync(le),Vc("endDumpTypes"),qp("Dump types","beginDumpTypes","endDumpTypes")}function Z(){if(!c)return;t.writeFileSyn

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

34`)}t.writeSync(le,`] L35: `),t.closeSync(le),Vc("endDumpTypes"),qp("Dump types","beginDumpTypes","endDumpTypes")}function Z(){if(!c)return;t.writeFileSync(c,JSON.stringify(_))}e.dumpLegend=Z})(kA||(kA={}));... L36: `,ft=u;continue}u++}return w.assert(qt!==void 0),k=yt,qt}function Fe(ae){let $e=u;if(u++,u>=g)return Q(p.Unexpected_end_of_text),"";let ft=Z(u);switch(u++,ft){case 48:if(u>=g||!WE(...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L34

34`)}t.writeSync(le,`] L35: `),t.closeSync(le),Vc("endDumpTypes"),qp("Dump types","beginDumpTypes","endDumpTypes")}function Z(){if(!c)return;t.writeFileSync(c,JSON.stringify(_))}e.dumpLegend=Z})(kA||(kA={}));... L36: `,ft=u;continue}u++}return w.assert(qt!==void 0),k=yt,qt}function Fe(ae){let $e=u;if(u++,u>=g)return Q(p.Unexpected_end_of_text),"";let ft=Z(u);switch(u++,ft){case 48:if(u>=g||!WE(...

server-bundle/openclaude/node_modules/web-tree-sitter/tree-sitter.jsView file

2977var func = `(${args}) => { ${body} };`; L2978: ASM_CONSTS[start] = eval(func); L2979: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

server-bundle/openclaude/node_modules/web-tree-sitter/tree-sitter.jsView on unpkg · L2977

server-bundle/node-pty/prebuilds/win32-x64/pty.nodeView file

•path = server-bundle/node-pty/prebuilds/win32-x64/pty.node kind = native_binary sizeBytes = 303104 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

server-bundle/node-pty/prebuilds/win32-x64/pty.nodeView on unpkg

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

server-bundle/openclaude/node_modules/sharp/src/binding.gypView file

•path = server-bundle/openclaude/node_modules/sharp/src/binding.gyp kind = build_helper sizeBytes = 10597 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server-bundle/openclaude/node_modules/sharp/src/binding.gypView on unpkg

web-dist/assets/main-rkwt24h5.jsView file

•path = web-dist/assets/main-rkwt24h5.js kind = oversized_source_file sizeBytes = 9525548 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-rkwt24h5.jsView on unpkg

server-bundle/openclaude/dist/cli.mjsView file

•path = server-bundle/openclaude/dist/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 22174420 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

server-bundle/openclaude/dist/cli.mjsView on unpkg

server-bundle/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/unixTerminal.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server-bundle/node-pty/lib/unixTerminal.jsView on unpkg

server-bundle/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server-bundle/node-pty/lib/windowsPtyAgent.jsView on unpkg

server-bundle/openclaude/node_modules/web-tree-sitter/lib/tree-sitter.cjsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.19 matchedPath = comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjs matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server-bundle/openclaude/node_modules/web-tree-sitter/lib/tree-sitter.cjsView on unpkg

server-bundle/openclaude/node_modules/web-tree-sitter/tree-sitter.cjsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.19 matchedPath = comate-engine/node_modules/web-tree-sitter/tree-sitter.cjs matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server-bundle/openclaude/node_modules/web-tree-sitter/tree-sitter.cjsView on unpkg