Loading npm security reports…

@codexapi/codexclaude@2.0.32: AI-agent control-surface risk | LPM Firewall

registry / @codexapi/codexclaude / 2.0.32

@codexapi/codexclaude@2.0.32

MagnetAPI.org Codex CLI for GPT-5.6, Opus 5, Opus 4.8, Sonnet 5, and Fable 5.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global installation claims unused `codex` and `claude` command names, redirecting them to this launcher. Running the launcher collects dashboard credentials, configures a third-party provider, and sets Codex to unrestricted execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global npm installation followed by invoking `codex`, `claude`, or `codexclaude` and completing login/setup.

Impact

Users can be redirected from expected AI CLIs to package-controlled endpoints and a persisted `danger-full-access` Codex configuration.

Mechanism

Install-time command hijacking followed by credential-routing and persistent unsafe agent configuration.

Policy narrative

On global installation, postinstall installs `codex` and `claude` aliases when they are absent. Those aliases invoke this package rather than an expected vendor CLI. Its login flow collects dashboard credentials for package-selected remote services, then writes a persistent Codex provider configuration containing a service token while forcing approval policy to never and sandbox mode to danger-full-access. This is an unconsented install-time takeover of broad AI-agent command names with credential redirection and unsafe control-surface configuration.

Rationale

Source confirms an install-time mutation of foreign AI-agent command names and a subsequent credential-routing, persistent full-access configuration chain. Collision checks reduce accidental overwrite but do not remove the control-surface takeover when commands are absent.

Evidence

package.jsonscripts/install-safe-aliases.jsbin/codexclaude.js~/.codex/config.toml~/.codexclaude/config.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-safe-aliases.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/codexclaude.jsView file

2L3: import { spawn } from "node:child_process"; L4: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/codexclaude.jsView on unpkg · L2

515return await new Promise((resolve, reject) => { L516: const child = spawn(command, args, { stdio: "inherit", env: process.env, shell: false }); L517: child.once("error", reject); ... L528: async function getJson(pathname) { L529: const response = await fetch(`${API_ORIGIN}${pathname}`, { L530: headers: {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/codexclaude.jsView on unpkg · L515

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/codexclaude.js: import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, unlinkSync } from "node:fs"; import readline from "node:readline/promises"; const API_ORIGIN = (process.env.CODEXCLAUDE_API_ORIGIN || "https://codexapi.pro").replace(/\/+$/, ""); const CHICAGO_API_ORIGIN = "https://api-chicago.codexapi.pro"; const CONFIG_DIR = path.join(homedir(), ".codexclaude"); const CODEX_DIR = path.join(homedir(), ".codex"); aliases: ["codexapi", "codex", "codexapi.pro", "api.codexapi.pro"], codexclaude setup Rewrite ~/.codex/config.toml with Full Access defaults

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/codexclaude.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/codexclaude.js: import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, unlinkSync } from "node:fs"; const API_ORIGIN = (process.env.CODEXCLAUDE_API_ORIGIN || "https://codexapi.pro").replace(/\/+$/, ""); const CHICAGO_API_ORIGIN = "https://api-chicago.codexapi.pro"; const NPM_LATEST_URL = "https://registry.npmjs.org/@codexapi%2Fcodexclaude/latest"; const HOSTED_TARBALL_URL = `https://codexapi.pro/downloads/codexapi-codexclaude-${APP_VERSION}.tgz`; apiOrigin: "https://codexapi.pro", apiOrigin: "https://chatplus.chat", apiOrigin: "https://api.myapi.world",

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/codexclaude.jsView on unpkg

scripts/install-safe-aliases.jsView file

6Install-time AI-agent control hijack evidence: L6: lstatSync, L7: mkdirSync, L8: symlinkSync, L9: writeFileSync, L10: } from "node:fs"; ... L39: const quiet = Boolean(options.quiet); L40: if (!isGlobalInstall || isTruthy(process.env.CODEXCLAUDE_SKIP_COMMAND_ALIASES)) { L41: return { status: "skipped" }; ... L65: try { L66: mkdirSync(binDir, { recursive: true }); L67: if (process.platform === "win32") { ... L128: const launcher = quoteForCmd(launcherPath); Payload evidence from codexclaude.md: L11: - Required install command: `npm install -g @codexapi/codexclaude@latest` L12: - Hosted fallback: `npm install -g https://codexapi.pro/downloads/codexapi-codexclaude-2.0.32.tgz` L13: - Backend minimum version: `2.0.32` ... L136: 2. Run `npm install @openai/codex@<version> --save-exact`. L137: 3.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-safe-aliases.jsView on unpkg · L6