registry / @codexapi/claudecodex / 1.0.3
@codexapi/claudecodex@1.0.3
MagnetAPI.org ClaudeCodex CLI for Fable 5.1, ChatGPT-6-Astra, Opus 5, Sonnet 5 and GPT-5.6.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
UrlStrings
NoLicense
Source & flagged code
4 flaggedbin/claudecodex.jsView file
2L3: import { spawn, spawnSync } from "node:child_process";
L4: import { installedPackage, npmInvocation, performUpdate, releaseTarget } from "./update.js";
High
2L3: import { spawn, spawnSync } from "node:child_process";
L4: import { installedPackage, npmInvocation, performUpdate, releaseTarget } from "./update.js";
...
L16: const APP_DISPLAY_NAME = "MagnetAPI.org ClaudeCodex CLI";
L17: const API_ORIGIN = (process.env.CLAUDECODEX_API_ORIGIN || "https://codexapi.pro").replace(/\/+$/, "");
L18: const VERSION_CHECK_PATH = "/api/v1/claudecodex/version";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/claudecodex.jsView on unpkg · L2•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/claudecodex.js:
import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
import readline from "node:readline/promises";
const API_ORIGIN = (process.env.CLAUDECODEX_API_ORIGIN || "https://codexapi.pro").replace(/\/+$/, "");
const CONFIG_DIR = path.join(homedir(), ".claudecodex");
const rl = readline.createInterface({ input, output });
const rl = readline.createInterface({ input, output });
if (!isTruthy(process.env.CLAUDECODEX_QUIET_STATUS)) {
if (isTruthy(process.env.CLAUDECODEX_DISABLE_UPDATE_CHECK)) return false;
Findings
5 High2 Medium4 Low
HighChild Processbin/claudecodex.js
HighShell
HighSame File Env Network Executionbin/claudecodex.js
HighCredential Redirect Persistencebin/claudecodex.js
HighPrevious Version Dangerous Deltabin/claudecodex.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @codexapi/claudecodex@1.0.3.
See all versions of @codexapi/claudecodex for other recorded verdicts.
- Review the evidence and your use of @codexapi/claudecodex@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.