Loading npm security reports…

@essentialai/cogent-bridge@3.23.9: Malicious npm security report | LPM Firewall

registry / @essentialai/cogent-bridge / 3.23.9

@essentialai/cogent-bridge@3.23.9

Cogent Bridge — cross-agent comms for Claude Code, OpenAI Codex and Slack. Codex users: install with `curl -fsSL https://cogent.tools/install.sh | sh`, then start with `cogent-codex` for real-time peer wake.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

A global npm installation automatically modifies the user's Codex environment. It downloads and executes a remote shell installer, then adds a marketplace and installs a Codex plugin.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install -g @essentialai/cogent-bridge on a non-CI Unix system

Impact

Unconsented code execution from a remote installer and mutation of the user's AI-agent control surface.

Mechanism

Postinstall remote shell execution and automatic Codex plugin installation

Attack narrative

The postinstall lifecycle hook activates automatically during a global install. It invokes a shell pipeline that downloads an installer from chatgpt.com and executes it, then uses the Codex CLI to add a marketplace and install a plugin. These actions alter a separate AI-agent installation without an explicit setup command or confirmation.

AI rationale

The global-install guard limits exposure, but it does not provide consent for an npm lifecycle hook to execute downloaded shell code and modify the user's Codex installation. This is concrete install-hook abuse of a foreign AI-agent control surface.

Evidence

package.jsonscripts/postinstall-global.mjs~/.codex/packages/standalone

Network endpoints2

chatgpt.com/codex/install.shgithub.com/eaisdevelopment/cogent.git

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-global.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/bin/cogent-codex.jsView file

31*/ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { realpathSync } from "node:fs"; ... L40: function log(msg) { L41: process.stderr.write(`[cogent-codex] ${msg}\n`); L42: } ... L91: log("setting up real-time wake — installing codex's managed build (one-time)…"); L92: const res = spawnSync("sh", ["-c", "curl -fsSL https://chatgpt.com/codex/install.sh | sh"], { L93: stdio: "inherit", ... L202: async function main() { L203: loadConfig(process.env); L204: const codexBin = getConfig().COGENT_CODEX_PATH;

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/cogent-codex.jsView on unpkg · L31

31Trigger-reachable chain: manifest.bin -> dist/bin/cogent-codex.js L31: */ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { realpathSync } from "node:fs"; ... L40: function log(msg) { L41: process.stderr.write(`[cogent-codex] ${msg}\n`); L42: } ... L91: log("setting up real-time wake — installing codex's managed build (one-time)…"); L92: const res = spawnSync("sh", ["-c", "curl -fsSL https://chatgpt.com/codex/install.sh | sh"], { L93: stdio: "inherit", ... L202: async function main() { L203: loadConfig(process.env); L204: const codexBin = getConfig().COGENT_CODEX_PATH;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/cogent-codex.jsView on unpkg · L31

•matchType = previous_version_dangerous_delta matchedPackage = @essentialai/cogent-bridge@3.20.5 matchedIdentity = npm:[redacted]:3.20.5 similarity = 0.619 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/cogent-codex.jsView on unpkg

31*/ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin/cogent-codex.jsView on unpkg · L31

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/bin/cogent-codex.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/cogent-codex.jsView on unpkg

dist/backend/npm-update-check.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/backend/npm-update-check.js#virtual:normalized:round1View on unpkg

dist/services/codex-app-server.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/codex-app-server.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-app-server.jsView on unpkg

dist/services/codex-preflight.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/codex-preflight.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-preflight.jsView on unpkg

dist/startup.jsView file

•matchType = token_shingles matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/startup.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/startup.jsView on unpkg

scripts/postinstall-global.mjsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = scripts/postinstall-global.mjs matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-global.mjsView on unpkg

dist/services/cc-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/cc-cli.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/cc-cli.jsView on unpkg

dist/services/codex-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/codex-cli.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-cli.jsView on unpkg

dist/backend/npm-update-check.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/backend/npm[redacted] matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend/npm-update-check.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 19-59json

19 "cogent-codex": "dist/bin/cogent-codex.js"

20 },

21 "files": [

22 "dist",

23 "README.md",

24 "LICENSE",

25 "CHANGELOG.md",

26 "server.json",

27 "scripts/postinstall-global.mjs"

28 ],

29 "scripts": {

30 "start": "node dist/index.js",

31 "dev": "tsx watch src/index.ts",

32 "build": "node node_modules/typescript/bin/tsc && npm run build:bundle",

33 "build:bundle": "node scripts/build-bundle.mjs",

34 "clean": "rm -rf dist plugin/bridge",

35 "test": "node node_modules/vitest/vitest.mjs run",

36 "test:watch": "node node_modules/vitest/vitest.mjs",

37 "test:unit": "node node_modules/vitest/vitest.mjs run --exclude 'src/e2e/**'",

38 "test:coverage": "node node_modules/vitest/vitest.mjs run --coverage",

39 "postinstall": "node scripts/postinstall-global.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

40 "prepublishOnly": "npm run build && npm run typecheck && npm test",

41 "typecheck": "node node_modules/typescript/bin/tsc -p tsconfig.test.json --noEmit",

42 "test:all": "node scripts/test-all.mjs",

43 "secret-scan": "node scripts/secret-scan.mjs",

44 "verify": "npm run typecheck && npm run test:all && node scripts/artifact-staleness-test.mjs && node scripts/dist-blackbox-test.mjs && node scripts/gate-runbook-coverage-test.mjs && node scripts/gate-proof-coverage-test.mjs"

45 },

46 "keywords": [

47 "mcp",

48 "model-context-protocol",

49 "claude",

50 "claude-code",

51 "bridge",

52 "inter-session",

53 "communication",

54 "ai",

55 "agent",

56 "cogent",

57 "cogent-bridge"

58 ],

59 "repository": {

dist/bin/cogent-codex.jsView file

Lines 11-51javascript

11 *

12 * The ONLY user step is running `cogent-codex` instead of `codex`. This wrapper

13 * self-bootstraps everything else, no exports / config /

dist/backend/npm-update-check.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/backend/npm-update-check.js#virtual:normalized:round1View on unpkg

dist/services/codex-app-server.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/codex-app-server.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-app-server.jsView on unpkg

dist/services/codex-preflight.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/codex-preflight.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-preflight.jsView on unpkg

dist/startup.jsView file

•matchType = token_shingles matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/startup.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/startup.jsView on unpkg

scripts/postinstall-global.mjsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = scripts/postinstall-global.mjs matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-global.mjsView on unpkg

dist/services/cc-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/cc-cli.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/cc-cli.jsView on unpkg

dist/services/codex-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/services/codex-cli.js matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-cli.jsView on unpkg

dist/backend/npm-update-check.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.22.0 matchedPath = dist/backend/npm[redacted] matchedIdentity = npm:[redacted]:3.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend/npm-update-check.jsView on unpkg