Loading npm security reports…

@codexed/codex@0.153.2-codexed.1: AI-agent control-surface risk | LPM Firewall

registry / @codexed/codex / 0.153.2-codexed.1

@codexed/codex@0.153.2-codexed.1

<p align="center"><strong>Codex CLI</strong> is a coding agent from OpenAI that runs locally on your computer. <p align="center"> <img src="https://github.com/openai/codex/blob/main/.github/codex-cli-splash.png" alt="Codex CLI splash" width="80%" /> </p

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically replaces the existing codex command launcher. The replacement forwards future codex invocations to this package and then to a platform native binary.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Global npm installation of the package.

Impact

It hijacks the global codex AI-agent command without checking whether an existing launcher belongs to this package.

Mechanism

Postinstall launcher replacement and native-binary dispatch.

Policy narrative

Installing this package globally invokes postinstall. On POSIX systems it deletes the current prefix/bin/codex path and replaces it with a symlink to its own launcher; on Windows it writes replacement command and PowerShell launchers. Later codex invocations execute the package-selected platform binary. The code does not verify ownership of the overwritten launcher.

Rationale

This is an automatic postinstall mutation of a pre-existing global AI-agent command surface, rather than normal package-local bin linking. No source evidence shows network exfiltration, but the unconsented launcher overwrite is concrete install-hook abuse.

Evidence

package.jsonscripts/postinstall.mjsbin/codex.js/usr/local/bin/codexcodex.cmdcodex.ps1

Decision evidence

public snapshot

Source & flagged code

8 flagged · loading source

package.jsonView file

•dependencies registry_only=@codexed/codex-linux-arm64,@codexed/codex-linux-x64,@codexed/codex-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

23"scripts": { "postinstall": "node scripts/postinstall.mjs" }

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically.

package.jsonView on unpkg · L23

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

2L3: import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs"; L4: import os from "node:os"; ... L26: const launcherPath = path.join(binDir, "codex"); L27: const tmpPath = `${launcherPath}.codexed-tmp`; L28: L29: mkdirSync(binDir, { recursive: true }); L30: chmodSync(codexJs, 0o755); ... L42: L43: mkdirSync(launcherDir, { recursive: true }); L44: L45: writeFileSync(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

24function replacePosixLauncher(prefix) { const binDir = path.join(prefix, "bin"); const launcherPath = path.join(binDir, "codex"); const tmpPath = `${launcherPath}.codexed-tmp`; mkdirSync(binDir, { recursive: true }); chmodSync(codexJs, 0o755); rmSync(tmpPath, { force: true }); symlinkSync(codexJs, tmpPath); rmSync(launcherPath, { force: true, recursive: true }); renameSync(tmpPath, launcherPath); }

High

Ai Review Evidence

On global installation, the hook removes the existing codex launcher and replaces it with a symlink to this package.

scripts/postinstall.mjsView on unpkg · L24

37function replaceWindowsLauncher(prefix) { const launcherDir = prefix; const cmdPath = path.join(launcherDir, "codex.cmd"); const ps1Path = path.join(launcherDir, "codex.ps1"); const escapedCodexJs = codexJs.replace(/\\/g, "\\\\"); mkdirSync(launcherDir, { recursive: true }); writeFileSync( cmdPath, `@ECHO OFF\r\nnode "${escapedCodexJs}" %*\r\n`, "utf8", ); writeFileSync( ps1Path, `#!/usr/bin/env pwsh\nnode "${escapedCodexJs}" $args\n`, "utf8", ); }

bin/codex.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codexed/codex@0.147.0-codexed.1 matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.147.0-codexed.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/codex.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 3-32json

3 "version": "0.153.2-codexed.1",

4 "license": "Apache-2.0",

5 "bin": {

6 "codex": "bin/codex.js"

7 },

8 "type": "module",

9 "engines": {

10 "node": ">=16"

11 },

12 "files": [

13 "bin",

14 "scripts",

15 "README.md"

16 ],

17 "repository": {

18 "type": "git",

19 "url": "git+https://github.com/openai/codex.git",

20 "directory": "codex-cli"

21 },

22 "packageManager": "pnpm@10.34.5+sha512.a4ee05f2f73658255bd6a89859c065a45c28a57daefae2c893a168ee2b73168c37b91e83e57ea67654ad03f03031746430e8bce38e362e042605fb8abc80192e",

23 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L23

24 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 },

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically.

package.jsonView on unpkg · L23

26 "optionalDependencies": {

27 "@codexed/codex-linux-x64": "0.153.2-codexed.1",

28 "@codexed/codex-linux-arm64": "0.153.2-codexed.1",

29 "@codexed/codex-win32-x64": "0.153.2-codexed.1"

30 }

31}

32

scripts/postinstall.mjsView file

Lines 1-57javascript

1#!/usr/bin/env node

2

3import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

4import os from "node:os";

5import path from "node:path";

6import

bin/codex.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codexed/codex@0.147.0-codexed.1 matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.147.0-codexed.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/codex.jsView on unpkg