Loading npm security reports…

@codexed/codex@0.153.1-codexed.1: AI-agent control-surface risk | LPM Firewall

registry / @codexed/codex / 0.153.1-codexed.1

@codexed/codex@0.153.1-codexed.1

<p align="center"><strong>Codex CLI</strong> is a coding agent from OpenAI that runs locally on your computer. <p align="center"> <img src="https://github.com/openai/codex/blob/main/.github/codex-cli-splash.png" alt="Codex CLI splash" width="80%" /> </p

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global installation automatically replaces the existing broadly named Codex launcher. It does not verify that the launcher belongs to this package.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm global installation, which runs postinstall.

Impact

A pre-existing Codex command can be replaced, redirecting future user invocations to this package.

Mechanism

Unconditional global launcher deletion and replacement.

Policy narrative

Installing this package globally triggers postinstall. The hook derives the global npm prefix, deletes prefix/bin/codex on POSIX systems, and atomically substitutes a symlink to its own launcher. On Windows it writes replacement command and PowerShell launchers. Because it performs no ownership check, it can overwrite a launcher supplied by another package or installation and take control of later codex invocations.

Rationale

The package has a concrete automatic install-time overwrite of a broad, potentially foreign AI-agent command surface. Its lack of network or credential behavior limits scope but does not remove the launcher-hijack risk.

Evidence

package.jsonscripts/postinstall.mjsbin/codex.jsprefix/bin/codexprefix/codex.cmdprefix/codex.ps1

Decision evidence

public snapshot

Source & flagged code

8 flagged · loading source

package.jsonView file

•dependencies registry_only=@codexed/codex-linux-arm64,@codexed/codex-linux-x64,@codexed/codex-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

23"scripts": { "postinstall": "node scripts/postinstall.mjs" }

High

Suspicious Lifecycle Evidence

The automatic postinstall hook runs the installer.

package.jsonView on unpkg · L23

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

2L3: import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs"; L4: import os from "node:os"; ... L26: const launcherPath = path.join(binDir, "codex"); L27: const tmpPath = `${launcherPath}.codexed-tmp`; L28: L29: mkdirSync(binDir, { recursive: true }); L30: chmodSync(codexJs, 0o755); ... L42: L43: mkdirSync(launcherDir, { recursive: true }); L44: L45: writeFileSync(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

24function replacePosixLauncher(prefix) { const binDir = path.join(prefix, "bin"); const launcherPath = path.join(binDir, "codex"); const tmpPath = `${launcherPath}.codexed-tmp`; mkdirSync(binDir, { recursive: true }); chmodSync(codexJs, 0o755); rmSync(tmpPath, { force: true }); symlinkSync(codexJs, tmpPath); rmSync(launcherPath, { force: true, recursive: true }); renameSync(tmpPath, launcherPath); }

High

Ai Review Evidence

On global installs, the installer recursively removes the existing prefix/bin/codex and replaces it with its own symlink.

scripts/postinstall.mjsView on unpkg · L24

37function replaceWindowsLauncher(prefix) { const launcherDir = prefix; const cmdPath = path.join(launcherDir, "codex.cmd"); const ps1Path = path.join(launcherDir, "codex.ps1"); const escapedCodexJs = codexJs.replace(/\\/g, "\\\\"); mkdirSync(launcherDir, { recursive: true }); writeFileSync( cmdPath, `@ECHO OFF\r\nnode "${escapedCodexJs}" %*\r\n`, "utf8", ); writeFileSync( ps1Path, `#!/usr/bin/env pwsh\nnode "${escapedCodexJs}" $args\n`, "utf8", ); }

bin/codex.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codexed/codex@0.147.0-codexed.1 matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.147.0-codexed.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/codex.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 3-32json

3 "version": "0.153.1-codexed.1",

4 "license": "Apache-2.0",

5 "bin": {

6 "codex": "bin/codex.js"

7 },

8 "type": "module",

9 "engines": {

10 "node": ">=16"

11 },

12 "files": [

13 "bin",

14 "scripts",

15 "README.md"

16 ],

17 "repository": {

18 "type": "git",

19 "url": "git+https://github.com/openai/codex.git",

20 "directory": "codex-cli"

21 },

22 "packageManager": "pnpm@10.34.5+sha512.a4ee05f2f73658255bd6a89859c065a45c28a57daefae2c893a168ee2b73168c37b91e83e57ea67654ad03f03031746430e8bce38e362e042605fb8abc80192e",

23 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L23

24 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 },

High

Suspicious Lifecycle Evidence

The automatic postinstall hook runs the installer.

package.jsonView on unpkg · L23

26 "optionalDependencies": {

27 "@codexed/codex-linux-x64": "0.153.1-codexed.1",

28 "@codexed/codex-linux-arm64": "0.153.1-codexed.1",

29 "@codexed/codex-win32-x64": "0.153.1-codexed.1"

30 }

31}

32

scripts/postinstall.mjsView file

Lines 1-57javascript

1#!/usr/bin/env node

2

3import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

4import os from "node:os";

5import path from "node:path";

6import

bin/codex.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codexed/codex@0.147.0-codexed.1 matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.147.0-codexed.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/codex.jsView on unpkg