registry / AI-agent control-surface risk / @codexed/codex
@codexed/codex
<p align="center"><strong>Codex CLI</strong> is a coding agent from OpenAI that runs locally on your computer. <p align="center"> <img src="https://github.com/openai/codex/blob/main/.github/codex-cli-splash.png" alt="Codex CLI splash" width="80%" /> </p
This report shows the evidence for @codexed/codex@0.153.4-codexed.4. 17 of 34 known versions are blocked or flagged. The newest version, 0.160.0-codexed.4, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic global launcher takeover is concrete, destructive, and targets a broad AI-agent control surface. The global-install guard does not establish consent to replace any pre-existing codex command.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing this package globally through npm, which runs postinstall.
Impact
Subsequent codex commands run the package-controlled launcher instead of the previously installed command.
Mechanism
Install-time replacement of the global Codex launcher.
Policy narrative
The package declares a postinstall hook. When installed globally, it resolves an npm prefix, removes prefix/bin/codex, and installs a symlink to its own launcher; on Windows it writes replacement command wrappers. This is an unconsented lifecycle mutation of the global AI-agent command surface and can replace an existing Codex installation.
AI rationale
The automatic global launcher takeover is concrete, destructive, and targets a broad AI-agent control surface. The global-install guard does not establish consent to replace any pre-existing codex command.
Evidence
package.jsonscripts/postinstall.mjsbin/codex.js<npm prefix>/bin/codex<npm prefix>/codex.cmd<npm prefix>/codex.ps1
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The automatic postinstall runs an installer script.
- On global installation, that script deletes the existing POSIX codex launcher and replaces it with a symlink to this package.
- On Windows, the same lifecycle script overwrites codex.cmd and codex.ps1 to invoke this package.
- The package uses the @codexed name while its metadata points to the OpenAI Codex repository.
Evidence against
- The lifecycle script exits for non-global installs.
- The inspected JavaScript contains no network requests or credential collection.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•dependencies registry_only=@codexed/codex-linux-arm64,@codexed/codex-linux-x64,@codexed/codex-win32-x64
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg23"scripts": {
"postinstall": "node scripts/postinstall.mjs"
}
High
Suspicious Lifecycle Evidence
The automatic postinstall runs an installer script.
package.jsonView on unpkg · L23•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.mjsView file
2L3: import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
L4: import os from "node:os";
...
L26: const launcherPath = path.join(binDir, "codex");
L27: const tmpPath = `${launcherPath}.codexed-tmp`;
L28:
L29: mkdirSync(binDir, { recursive: true });
L30: chmodSync(codexJs, 0o755);
...
L42:
L43: mkdirSync(launcherDir, { recursive: true });
L44:
L45: writeFileSync(
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.mjsView on unpkg · L2bin/codex.jsView file
•matchType = normalized_sha256
matchedPackage = @codexed/codex@0.153.4-codexed.1
matchedPath = bin/codex.js
matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.153.4-codexed.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/codex.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = a0a24c0188b5c1ed
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @codexed/codex@0.153.4-codexed.1
matchedPath = bin/codex.js
matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.153.4-codexed.1
similarity = 1.000
shingleOverlap = 2
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/codex.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @codexed/codex@0.147.0-codexed.1
matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.147.0-codexed.1
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/codex.jsView on unpkgFindings
2 Critical5 High3 Medium2 Low
CriticalAi Agent Control Hijackscripts/postinstall.mjs
CriticalManifest Confusionpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritybin/codex.js
HighKnown Malware Source Fingerprint Signaturebin/codex.js
HighPrevious Version Dangerous Deltabin/codex.js
HighSuspicious Lifecycle Evidencepackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @codexed/codex@0.153.4-codexed.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @codexed/codex@0.153.4-codexed.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
34 known versions0.160.0-codexed.4latestSuspiciousInstall Hook AbuseWarnPublishedOct 3, 2026, 10:41 PM0.160.0-codexed.3Clean—AllowPublishedOct 2, 2026, 11:19 PM0.160.0-codexed.1Clean—AllowPublishedOct 2, 2026, 9:19 AM0.159.3-codexed.1Clean—AllowPublishedOct 1, 2026, 1:33 AM0.159.2-codexed.1Clean—AllowPublishedSep 30, 2026, 8:31 AM0.159.1-codexed.2Clean—AllowPublishedSep 30, 2026, 6:13 AM0.159.1-codexed.1Clean—AllowPublishedSep 29, 2026, 11:16 PM0.156.1-codexed.2Clean—AllowPublishedSep 24, 2026, 8:03 AM0.156.1-codexed.1Clean—AllowPublishedSep 23, 2026, 11:24 AM0.156.0-codexed.1Clean—AllowPublishedSep 23, 2026, 12:06 AM0.154.0-codexed.1Clean—AllowPublishedSep 12, 2026, 8:01 PM0.153.4-codexed.4shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 5, 2026, 1:47 PM0.153.4-codexed.1MaliciousInstall Hook AbuseBlockPublishedSep 5, 2026, 1:17 AM0.153.3-codexed.1MaliciousInstall Hook AbuseBlockPublishedSep 5, 2026, 12:15 AM0.153.2-codexed.1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 1:19 AM0.153.1-codexed.1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 3, 2026, 11:09 PM0.151.0-codexed.1Clean—AllowPublishedAug 30, 2026, 3:35 AM0.150.1-codexed.2MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 28, 2026, 8:38 AM0.150.1-codexed.1Clean—AllowPublishedAug 27, 2026, 3:53 PM0.149.1-codexed.1Clean—AllowPublishedAug 24, 2026, 5:08 PM0.149.0-codexed.7MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 23, 2026, 9:34 AM0.149.0-codexed.6MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 23, 2026, 9:08 AM0.149.0-codexed.5MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 23, 2026, 12:35 AM0.149.0-codexed.4MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 22, 2026, 11:47 PM0.149.0-codexed.3MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 22, 2026, 10:52 PM0.149.0-codexed.2MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 22, 2026, 1:53 PM0.149.0-codexed.1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 22, 2026, 11:14 AM0.147.0-codexed.4MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 18, 2026, 4:56 PM0.147.0-codexed.3MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 17, 2026, 11:37 PM0.147.0-codexed.2MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 17, 2026, 10:14 PM0.147.0-codexed.1SuspiciousAgent extension lifecycle riskWarnPublishedAug 8, 2026, 8:55 PM0.144.6-codexed.1MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 18, 2026, 5:16 PM0.144.4-codexed.2SuspiciousDestructive ActionWarnPublishedJul 15, 2026, 5:22 PM0.142.4-codexed.1SuspiciousSoft block: AI-agent control surfaceWarnPublishedJun 30, 2026, 3:18 PM