Loading npm security reports…

@codexed/codex@0.149.0-codexed.3: AI-agent control-surface risk | LPM Firewall

registry / @codexed/codex / 0.149.0-codexed.3

@codexed/codex@0.149.0-codexed.3

<p align="center"><strong>Codex CLI</strong> is a coding agent from OpenAI that runs locally on your computer. <p align="center"> <img src="https://github.com/openai/codex/blob/main/.github/codex-cli-splash.png" alt="Codex CLI splash" width="80%" /> </p

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On global npm installation, the postinstall script deletes the existing `codex` launcher and replaces it with a launcher to this package. This hijacks a broad AI-agent CLI control surface without user confirmation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm global installation

Impact

Existing `codex` invocations are redirected to the package's binary.

Mechanism

postinstall replacement of the global `codex` command

Policy narrative

Installing this differently scoped package globally runs postinstall. On POSIX it recursively removes `<prefix>/bin/codex` and replaces it with a symlink to its own launcher; on Windows it overwrites `codex.cmd` and `codex.ps1`. The package claims to be OpenAI Codex in its README despite its `@codexed` identity. This unconsented install-time replacement redirects the primary Codex command to package-controlled binaries.

Rationale

The install hook deliberately overwrites an existing global AI-agent command rather than relying on npm's normal bin linking. That is a concrete unconsented control-surface hijack.

Evidence

package.jsonscripts/postinstall.mjsREADME.mdbin/codex.js<npm global prefix>/bin/codex<npm global prefix>/codex.cmd<npm global prefix>/codex.ps1

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•dependencies registry_only=@codexed/codex-linux-arm64,@codexed/codex-linux-x64,@codexed/codex-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2"name": "@codexed/codex", "version": "0.149.0-codexed.3", "license": "Apache-2.0", "bin": { "codex": "bin/codex.js"

High

Suspicious Dependency Evidence

Package identity and bundled dependencies use `@codexed`, while README presents it as OpenAI Codex.

package.jsonView on unpkg · L2

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

2L3: import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs"; L4: import os from "node:os"; ... L26: const launcherPath = path.join(binDir, "codex"); L27: const tmpPath = `${launcherPath}.codexed-tmp`; L28: L29: mkdirSync(binDir, { recursive: true }); L30: chmodSync(codexJs, 0o755); ... L42: L43: mkdirSync(launcherDir, { recursive: true }); L44: L45: writeFileSync(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

bin/codex.jsView file

•matchType = normalized_sha256 matchedPackage = @codexed/codex@0.149.0-codexed.2 matchedPath = bin/codex.js matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.149.0-codexed.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codex.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8b9951f2d34b50c6 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @codexed/codex@0.149.0-codexed.2 matchedPath = bin/codex.js matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.149.0-codexed.2 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/codex.jsView on unpkg

README.mdView file

1<p align="center"><strong>Codex CLI</strong> is a coding agent from OpenAI that runs locally on your computer.

High

Suspicious Dependency Evidence

Package identity and bundled dependencies use `@codexed`, while README presents it as OpenAI Codex.

README.mdView on unpkg · L1

Source & flagged code

8 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "@codexed/codex",

3 "version": "0.149.0-codexed.3",

4 "license": "Apache-2.0",

5 "bin": {

6 "codex": "bin/codex.js"

High

Suspicious Dependency Evidence

Package identity and bundled dependencies use `@codexed`, while README presents it as OpenAI Codex.

package.jsonView on unpkg · L2

7 },

8 "type": "module",

9 "engines": {

10 "node": ">=16"

11 },

12 "files": [

13 "bin",

14 "scripts",

15 "README.md"

16 ],

17 "repository": {

18 "type": "git",

19 "url": "git+https://github.com/openai/codex.git",

20 "directory": "codex-cli"

21 },

22 "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",

23 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L23

24 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 },

26 "optionalDependencies": {

27 "@codexed/codex-linux-x64": "0.149.0-codexed.3",

28 "@codexed/codex-linux-arm64": "0.149.0-codexed.3",

29 "@codexed/codex-win32-x64": "0.149.0-codexed.3"

30 }

31}

32

scripts/postinstall.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

4import os from "node:os";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

5import path

bin/codex.jsView file

•matchType = normalized_sha256 matchedPackage = @codexed/codex@0.149.0-codexed.2 matchedPath = bin/codex.js matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.149.0-codexed.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/codex.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8b9951f2d34b50c6 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @codexed/codex@0.149.0-codexed.2 matchedPath = bin/codex.js matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.149.0-codexed.2 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/codex.jsView on unpkg

README.mdView file

Lines 1-21markdown

1<p align="center"><strong>Codex CLI</strong> is a coding agent from OpenAI that runs locally on your computer.

High

Suspicious Dependency Evidence

Package identity and bundled dependencies use `@codexed`, while README presents it as OpenAI Codex.

README.mdView on unpkg · L1

2<p align="center">

3 <img src="https://github.com/openai/codex/blob/main/.github/codex-cli-splash.png" alt="Codex CLI splash" width="80%" />

4</p>

5</br>

6If you want Codex in your code editor (VS Code, Cursor, Windsurf), <a href="https://developers.openai.com/codex/ide">install in your IDE.</a>

7</br>If you want the desktop app experience, run <code>codex app</code> or visit <a href="https://chatgpt.com/codex?app-landing-page=true">the Codex App page</a>.