Loading npm security reports…

@codex-ultra/cxu@0.2.9: AI-agent control-surface risk | LPM Firewall

registry / @codex-ultra/cxu / 0.2.9

@codex-ultra/cxu@0.2.9

codex-ultra workbench launcher: server compiled locally with Bun + web UI (cxu starts it all).

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Starting or resuming a launcher thread can create instruction files across several unrelated AI-agent skill directories in the selected workspace. The files contain package-authored workflow instructions that can influence later agent sessions.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user starts, resumes, or runs a launcher thread with the VM feature enabled.

Impact

Persistent control over behavior of multiple AI coding-agent integrations in the project.

Mechanism

Automatic multi-agent SKILL.md injection into the workspace.

Policy narrative

The postinstall hook installs a compiled launcher server. When that server handles a thread start, turn start, or resume, it writes generated instructions into skill directories for five separate AI-agent ecosystems in the current workspace. The embedded instructions direct later agents' tool usage and workflow. This is a broad, persistent AI-agent control-surface modification that occurs automatically as part of the launcher lifecycle rather than through a separate explicit setup action.

AI rationale

The package combines an automatic lifecycle-installed server with automatic broad workspace agent-skill writes and embedded agent-directing instructions. This creates a concrete persistent agent-control hijack surface.

Evidence

package.jsondist/postinstall.jsserver-bundle/index.js.codex/skills/sa-vm/SKILL.md.claude/skills/sa-vm/SKILL.md.gemini/skills/sa-vm/SKILL.md.grok/skills/sa-vm/SKILL.md

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server-bundle/index.jsView file

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`: L4: ${Zu(h)}`:""}`))},Jh);d.stdout.on("data",h=>{l+=h.toString("utf8")}),d.stderr.on("data",h=>{c+=h.toString("utf8")}),d.once("exit",h=>{if(!p)if(p=!0,clearTimeout(m),h===0||this.hasU... L5: `);a(new Error(`Failed to ${r} daemon (code ${h}): ${Zu(u)}`))}}),d.once("error",h=>{p||(p=!0,clearTimeout(m),a(h))})})}daemonNeedsRuntimeEnvRestart(n){

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

server-bundle/index.jsView on unpkg · L1

2649${c}`)}}));let r=await R.loadWebAssemblyModule(await n,{loadAsync:!0}),s=Object.keys(r),o=s.find(d=>rM.test(d)&&!d.includes("external_scanner_"));if(!o)throw console.log(`Couldn't ... L2650: ${JSON.stringify(s,null,2)}`),new Error("Language.load failed: no language function found in WASM file");let a=r[o]();return new xb(Br,a)}},sM=(()=>{var _scriptName=import.meta.url... L2651: `);function s(o,a){for(let d=0;d<o.length;d++){let l=o[d];if(!l)continue;let c=d===o.length-1,p=c?"\u2514\u2500\u2500 ":"\u251C\u2500\u2500 ",m=a+(c?" ":"\u2502 "),h=`[L${l.st...

High

Eval

Package source references dynamic code evaluation.

server-bundle/index.jsView on unpkg · L2649

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server-bundle/index.jsView on unpkg · L1

•command output transform/external POST = de(r,"foreground");if(!l)throw d.stop(),t.delete(r),new error("autonomous remote thread route disappeared during attach");return{threadid:r,state:"foreground",remotecontinues:!0,route:l,status:d.getstatus()}}t.get(r)?.stop(),t.delete(r);let a=e.setlifecyclemode(r,"background");if(!a)throw new error("autonomous remote thread route disappeared during detach");return{threadid:r,state:"background",remotecontinues:!0,route:a}}import{eventemitter as ea}from"node:events";import{createreadstream as cs,existssync as ss}from"node:fs";import{createserver as as}from"node:net";import{arch as rs,platform as ps}from"node:os";import{dirname as ms,resolve as jp}from"node:path";import{fileurltopath as os}from"node:url";import{execfile as ns,spawn as gp}from"node:chil

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

server-bundle/index.jsView on unpkg

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... ... L649: `,p+"/release-id","600");let m=GS({releaseId:a,port:n,token:l,home:r.home,claudeEnabled:o!=="disabled"}),h=["[Unit]","Description=Codex Ultra Remote Bun Server","After=network-onli... L650: `);await Bp(t,m,"~/.codex-ultra/remote/server.env","600"),await Bp(t,h,"~/.config/systemd/user/"+fi,"600"),await Pr("ssh",[...t,'rm -rf "$HOME/.codex-ultra/remote/previous"; rm -f ... L651: `)+` ... L2649: ${c}`)}}));let r=a

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

server-bundle/index.jsView on unpkg · L1

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`: L4: ${Zu(h)}`:""}`))},Jh);d.stdout.on("data",h=>{l+=h.toString("utf8")}),d.stderr.on("data",h=>{c+=h.toString("utf8")}),d.once("exit",h=>{if(!p)if(p=!0,clearTimeout(m),h===0||this.hasU... L5: `);a(new Error(`Failed to ${r} daemon (code ${h}): ${Zu(u)}`))}}),d.once("error",h=>{p||(p=!0,clearTimeout(m),a(h))})})}daemonNeedsRuntimeEnvRestart(n){

Low

Weak Crypto

Package source references weak cryptographic algorithms.

server-bundle/index.jsView on unpkg · L1

dist/postinstall.jsView file

1import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/postinstall.jsView on unpkg · L1

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x1d53c5,_0x3055a8){function _0x2103f2(_0x4d010c,_0x3b59c4,_0x34f855,_0x3ae9f2){return _0x10ba(_0x3ae9f2-0x1f4,_0x3b59c4);}const _0x26572c=_0x1d53c5();function _0x345a21... Write operation from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @codex-ultra/cxu@0.2.8 matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.8 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1(function(_0x1d53c5,_0x3055a8){function _0x2103f2(_0x4d010c,_0x3b59c4,_0x34f855,_0x3ae9f2){return _0x10ba(_0x3ae9f2-0x1f4,_0x3b59c4);}const _0x26572c=_0x1d53c5();function _0x345a21...

High

Obfuscated Payload Loader

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-4g10184v.jsView file

•path = web-dist/assets/main-4g10184v.js kind = oversized_source_file sizeBytes = 9078854 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-4g10184v.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 11-51json

11 "import": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cxu": "dist/cli.js"

16 },

17 "files": [

18 "dist",

19 "wasm",

20 "web-dist",

21 "server-bundle",

22 "README.md",

23 "LICENSE"

24 ],

25 "scripts": {

26 "vendor": "node scripts/vendor-sa-vm.mjs",

27 "build": "node scripts/build.mjs",

28 "build:bun": "bun scripts/build.mjs",

29 "obfuscate": "node scripts/obfuscate.mjs",

30 "typecheck": "tsc -p tsconfig.json --noEmit",

31 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepack": "npm run build && npm run obfuscate",

33 "test": "bun test test/ 2>/dev/null || node --test test/*.test.mjs"

34 },

35 "publishConfig": {

36 "access": "public"

37 },

38 "dependencies": {

39 "tree-sitter-wasms": "^0.1.13",

40 "web-tree-sitter": "0.25.10"

41 },

42 "devDependencies": {

43 "esbuild": "^0.25.12",

44 "javascript-obfuscator": "^5.5.0",

45 "typescript": "^5.9.3"

46 },

47 "engines": {

48 "node": ">=18"

49 },

50 "license": "MIT",

51 "homepage": "https://github.com/layola13/codex-ultra#readme",

server-bundle/index.jsView file

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`: L4: ${Zu(h)}`:""}`))},Jh);d.stdout.on("data",h=>{l+=h.toString("utf8")}),d.stderr.on("data",h=>{c+=h.toString("utf8")}),d.once("exit",h=>{if(!p)if(p=!0,clearTimeout(m),h===0||this.hasU... L5: `);a(new Error(`Failed to ${r} daemon (code ${h}): ${Zu(u)}`))}}),d.once("error",h=>{p||(p=!0,clearTimeout(m),a(h))})})}daemonNeedsRuntimeEnvRestart(n){

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

server-bundle/index.jsView on unpkg · L1

2649${c}`)}}));let r=await R.loadWebAssemblyModule(await n,{loadAsync:!0}),s=Object.keys(r),o=s.find(d=>rM.test(d)&&!d.includes("external_scanner_"));if(!o)throw console.log(`Couldn't ... L2650: ${JSON.stringify(s,null,2)}`),new Error("Language.load failed: no language function found in WASM file");let a=r[o]();return new xb(Br,a)}},sM=(()=>{var _scriptName=import.meta.url... L2651: `);function s(o,a){for(let d=0;d<o.length;d++){let l=o[d];if(!l)continue;let c=d===o.length-1,p=c?"\u2514\u2500\u2500 ":"\u251C\u2500\u2500 ",m=a+(c?" ":"\u2502 "),h=`[L${l.st...

High

Eval

Package source references dynamic code evaluation.

server-bundle/index.jsView on unpkg · L2649

1var gI=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar... L2: `).slice(0,8e3)}function yt(e){let t=po(e),n=t?.mode==="enabled"||t?.mode==="disabled"?t.mode:"inherit",r=t?.childCount===null||t?.childCount===void 0?null:Number(t.childCount),s=r... L3: `);a(new Error(`Timed out waiting for Codex daemon ${r} after ${Jh}ms${h?`:

dist/postinstall.jsView file

Lines 1-2javascript

1import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"node:module"

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x1d53c5,_0x3055a8){function _0x2103f2(_0x4d010c,_0x3b59c4,_0x34f855,_0x3ae9f2){return _0x10ba(_0x3ae9f2-0x1f4,_0x3b59c4);}const _0x26572c=_0x1d53c5();function _0x345a21... Write operation from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as m}from"node:child_process";import{chmodSync as b,existsSync as h,mkdirSync as v,statSync as w,writeFileSync as k}from"node:fs";import{createRequire as y}from"no...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @codex-ultra/cxu@0.2.8 matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.8 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1(function(_0x1d53c5,_0x3055a8){function _0x2103f2(_0x4d010c,_0x3b59c4,_0x34f855,_0x3ae9f2){return _0x10ba(_0x3ae9f2-0x1f4,_0x3b59c4);}const _0x26572c=_0x1d53c5();function _0x345a21...

High

Obfuscated Payload Loader

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-4g10184v.jsView file

•path = web-dist/assets/main-4g10184v.js kind = oversized_source_file sizeBytes = 9078854 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-4g10184v.jsView on unpkg