Loading npm security reports…

@essentialai/cogent-bridge: AI-agent control-surface risk | LPM Firewall

registry / @essentialai/cogent-bridge / 3.20.4

@essentialai/cogent-bridge@3.20.4

MCP server for inter-Claude-Code session communication bridge

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall silently provisions a managed Codex build and installs a Codex plugin. It retrieves executable installer content over the network and mutates the user-wide Codex control surface.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install -g @essentialai/cogent-bridge

Impact

Unconsented execution of remote installer code and user-wide AI-agent extension installation.

Mechanism

postinstall remote shell installer plus Codex plugin registration

Policy narrative

On global installation, npm invokes a hook that executes a curl-piped shell installer from chatgpt.com and then invokes Codex to add a marketplace and install a plugin. The behavior is gated to global installs but is automatic once triggered, affecting user-wide Codex state rather than only this package's files.

Rationale

The package’s install hook performs unprompted remote-code installation and alters the broad, foreign Codex agent surface. This meets the blocking policy despite vendor-aligned endpoints. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/postinstall-global.mjs~/.codex/packages/standalone

Network endpoints2

chatgpt.com/codex/install.shgithub.com/eaisdevelopment/cogent.git

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-global.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/bin/cogent-codex.jsView file

31*/ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { readFile } from "node:fs/promises"; ... L39: function log(msg) { L40: process.stderr.write(`[cogent-codex] ${msg}\n`); L41: } ... L90: log("setting up real-time wake — installing codex's managed build (one-time)…"); L91: const res = spawnSync("sh", ["-c", "curl -fsSL https://chatgpt.com/codex/install.sh | sh"], { L92: stdio: "inherit", ... L201: async function main() { L202: loadConfig(process.env); L203: const codexBin = getConfig().COGENT_CODEX_PATH;

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/cogent-codex.jsView on unpkg · L31

31Trigger-reachable chain: manifest.bin -> dist/bin/cogent-codex.js L31: */ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { readFile } from "node:fs/promises"; ... L39: function log(msg) { L40: process.stderr.write(`[cogent-codex] ${msg}\n`); L41: } ... L90: log("setting up real-time wake — installing codex's managed build (one-time)…"); L91: const res = spawnSync("sh", ["-c", "curl -fsSL https://chatgpt.com/codex/install.sh | sh"], { L92: stdio: "inherit", ... L201: async function main() { L202: loadConfig(process.env); L203: const codexBin = getConfig().COGENT_CODEX_PATH;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/cogent-codex.jsView on unpkg · L31

•matchType = previous_version_dangerous_delta matchedPackage = @essentialai/cogent-bridge@3.20.1 matchedIdentity = npm:[redacted]:3.20.1 similarity = 0.935 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/cogent-codex.jsView on unpkg

31*/ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { readFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/bin/cogent-codex.jsView on unpkg · L31

dist/constants.jsView file

8try { L9: const require = createRequire(import.meta.url); L10: return require("../package.json").version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L8