registry / @codexed/codex / 0.160.0-codexed.3

@codexed/codex@0.160.0-codexed.3

<p align="center"><strong>Codex CLI</strong> is a coding agent from OpenAI that runs locally on your computer. <p align="center"> <img src="https://github.com/openai/codex/blob/main/.github/codex-cli-splash.png" alt="Codex CLI splash" width="80%" /> </p

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The lifecycle script is gated to global installs and configures this package's own command launcher. The inspected CLI delegates to its platform binary, with no source evidence of credential theft, unrelated agent configuration changes, or malicious network activity.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Package installation; the launcher setup runs only when the install is global.

Impact

Global installs make this CLI available through the configured prefix; no malicious effect was established.

Mechanism

The hook links or writes launcher files under the package manager prefix, and the CLI invokes the corresponding platform binary.

AI rationale

Evidence

bin/codexcodex.cmdcodex.ps1

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package exposes a CLI and runs a postinstall script.
The postinstall exits for non-global installs; for global installs it replaces the Codex launcher under the configured prefix.
The CLI starts the platform-specific Codex binary and forwards the caller's arguments and environment.

Evidence against

The inspected install behavior is limited to setting up this package's own global CLI launcher.
The inspected entry point delegates to the bundled platform binary; no separate credential collection or network behavior was identified.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 10.3 KB of source

Source & flagged code

8 flagged

package.jsonView file

•dependencies registry_only=@codexed/codex-linux-arm64,@codexed/codex-linux-x64,@codexed/codex-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

24"postinstall": "node scripts/postinstall.mjs" }, "optionalDependencies": { "@codexed/codex-linux-x64": "0.160.0-codexed.3", "@codexed/codex-linux-arm64": "0.160.0-codex

Low

Suspicious Lifecycle Evidence

The package exposes a CLI and runs a postinstall script.

package.jsonView on unpkg · L24

scripts/postinstall.mjsView file

2L3: import { chmodSync, mkdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs"; L4: import os from "node:os"; ... L26: const launcherPath = path.join(binDir, "codex"); L27: const tmpPath = `${launcherPath}.codexed-tmp`; L28: L29: mkdirSync(binDir, { recursive: true }); L30: chmodSync(codexJs, 0o755); ... L42: L43: mkdirSync(launcherDir, { recursive: true }); L44: L45: writeFileSync(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

57if (!isGlobalInstall()) { process.exit(0); } const prefix = resolvePrefix(); if (os.platform() === "win32") { replaceWindowsLauncher(prefix); } else { replacePosixLauncher(

Low

Suspicious Lifecycle Evidence

The postinstall exits for non-global installs; for global installs it replaces the Codex launcher under the configured prefix.

scripts/postinstall.mjsView on unpkg · L57

bin/codex.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codexed/codex@0.147.0-codexed.1 matchedIdentity = npm:QGNvZGV4ZWQvY29kZXg:0.147.0-codexed.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/codex.jsView on unpkg

241const child = spawn(binaryPath, process.argv.slice(2), { stdio: "inherit", env, }); child.on("error", (err) => { // Typically triggered when the binary is missing or not exe

Low

Ai Review Evidence

The CLI starts the platform-specific Codex binary and forwards the caller's arguments and environment.

bin/codex.jsView on unpkg · L241

Source & flagged code

8 flagged · loading source

package.jsonView file

•dependencies registry_only=@codexed/codex-linux-arm64,@codexed/codex-linux-x64,@codexed/codex-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

24"postinstall": "node scripts/postinstall.mjs" }, "optionalDependencies": { "@codexed/codex-linux-x64": "0.160.0-codexed.3", "@codexed/codex-linux-arm64": "0.160.0-codex

Findings

2 Critical2 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltabin/codex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidencescripts/postinstall.mjs

LowAi Review Evidencebin/codex.js

Affected versions and remediation

This report applies to @codexed/codex@0.160.0-codexed.3.

See all versions of @codexed/codex for other recorded verdicts.

Review the evidence and your use of @codexed/codex@0.160.0-codexed.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 05:25:47.055Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.