registry / @codori/server / 0.7.1

@codori/server@0.7.1

Codori server for Git project discovery, Codex runtime management, and bundled dashboard serving.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

An explicitly installed service can bind an unauthenticated Codori API to a network interface. Its API can start Codex runtimes and relay WebSocket RPC traffic.

Static reason

No blocking static signals were detected.

Trigger

User runs install-service (especially with --yes/default host) and exposes the selected interface.

Impact

Network-reachable callers could control project Codex sessions; this is a dangerous exposed control surface, not evidence of malicious intent.

Mechanism

Persistent unauthenticated Codex runtime-management server

Rationale

No install-time malware, secret theft, or covert payload was found. The unauthenticated persistent remote-control surface is substantial enough to warn.

Evidence

package.jsondist/config.jsdist/http-server.jsdist/process-manager.jsdist/service.jsdist/service-adapters.jsdist/service-update.js~/.codori/services/<installId>/run-service.sh~/.codori/services/<installId>/service.json~/Library/LaunchAgents/io.codori.server.<installId>.plist~/.config/systemd/user/codori-<installId>.service

Network endpoints2

ws://127.0.0.1:${port}/%40codori%2Fserver/latest

@codori/server@0.7.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code