@essentialai/cogent-bridge@3.25.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@essentialai/cogent-bridge@3.25.0: Suspicious npm security report | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-global.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/bin/cogent-codex.jsView file

31*/ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { realpathSync } from "node:fs"; ... L40: function log(msg) { L41: process.stderr.write(`[cogent-codex] ${msg}\n`); L42: } ... L91: log("setting up real-time wake — installing codex's managed build (one-time)…"); L92: const res = spawnSync("sh", ["-c", "curl -fsSL https://chatgpt.com/codex/install.sh | sh"], { L93: stdio: "inherit", ... L202: async function main() { L203: loadConfig(process.env); L204: const codexBin = getConfig().COGENT_CODEX_PATH;

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/cogent-codex.jsView on unpkg · L31

31Trigger-reachable chain: manifest.bin -> dist/bin/cogent-codex.js L31: */ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { realpathSync } from "node:fs"; ... L40: function log(msg) { L41: process.stderr.write(`[cogent-codex] ${msg}\n`); L42: } ... L91: log("setting up real-time wake — installing codex's managed build (one-time)…"); L92: const res = spawnSync("sh", ["-c", "curl -fsSL https://chatgpt.com/codex/install.sh | sh"], { L93: stdio: "inherit", ... L202: async function main() { L203: loadConfig(process.env); L204: const codexBin = getConfig().COGENT_CODEX_PATH;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/cogent-codex.jsView on unpkg · L31

31*/ L32: import { spawn, spawnSync } from "node:child_process"; L33: import { realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin/cogent-codex.jsView on unpkg · L31

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/bin/cogent-codex.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/cogent-codex.jsView on unpkg

dist/backend/npm-update-check.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/backend/npm-update-check.js#virtual:normalized:round1View on unpkg

dist/services/codex-app-server.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/codex-app-server.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-app-server.jsView on unpkg

dist/services/codex-preflight.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/codex-preflight.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-preflight.jsView on unpkg

scripts/postinstall-global.mjsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = scripts/postinstall-global.mjs matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-global.mjsView on unpkg

dist/services/cc-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/cc-cli.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/cc-cli.jsView on unpkg

dist/services/codex-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/codex-cli.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-cli.jsView on unpkg

dist/backend/npm-update-check.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/backend/npm[redacted] matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend/npm-update-check.jsView on unpkg

dist/services/auto-relay.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.9 matchedPath = dist/services/auto-relay.js matchedIdentity = npm:[redacted]:3.23.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/auto-relay.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 20-60json

20 },

21 "files": [

22 "dist",

23 "README.md",

24 "LICENSE",

25 "CHANGELOG.md",

26 "server.json",

27 "scripts/postinstall-global.mjs"

28 ],

29 "scripts": {

30 "start": "node dist/index.js",

31 "dev": "tsx watch src/index.ts",

32 "prebuild": "npm run build -w cogent",

33 "build": "node node_modules/typescript/bin/tsc && npm run build:bundle",

34 "build:bundle": "node scripts/build-bundle.mjs",

35 "clean": "rm -rf dist plugin/bridge",

36 "test": "node node_modules/vitest/vitest.mjs run",

37 "test:watch": "node node_modules/vitest/vitest.mjs",

38 "test:unit": "node node_modules/vitest/vitest.mjs run --exclude 'src/e2e/**'",

39 "test:coverage": "node node_modules/vitest/vitest.mjs run --coverage",

40 "postinstall": "node scripts/postinstall-global.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "prepublishOnly": "npm run build && npm run typecheck && npm test",

42 "typecheck": "node node_modules/typescript/bin/tsc -p tsconfig.test.json --noEmit",

43 "test:all": "node scripts/test-all.mjs",

44 "secret-scan": "node scripts/secret-scan.mjs",

45 "verify": "npm run typecheck && npm run test:all && node scripts/artifact-staleness-test.mjs && node scripts/dist-blackbox-test.mjs && node scripts/gate-runbook-coverage-test.mjs && node scripts/gate-proof-coverage-test.mjs && node scripts/cold-clone-test.mjs"

46 },

47 "keywords": [

48 "mcp",

49 "model-context-protocol",

50 "claude",

51 "claude-code",

52 "bridge",

53 "inter-session",

54 "communication",

55 "ai",

56 "agent",

57 "cogent",

58 "cogent-bridge"

59 ],

60 "repository": {

dist/bin/cogent-codex.jsView file

Lines 11-51javascript

11 *

12 * The ONLY user step is running `cogent-codex` instead of `codex`. This wrapper

13 * self-bootstraps everything else, no exports / config /

dist/backend/npm-update-check.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/backend/npm-update-check.js#virtual:normalized:round1View on unpkg

dist/services/codex-app-server.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/codex-app-server.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-app-server.jsView on unpkg

dist/services/codex-preflight.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/codex-preflight.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-preflight.jsView on unpkg

scripts/postinstall-global.mjsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = scripts/postinstall-global.mjs matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-global.mjsView on unpkg

dist/services/cc-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/cc-cli.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/cc-cli.jsView on unpkg

dist/services/codex-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/services/codex-cli.js matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/codex-cli.jsView on unpkg

dist/backend/npm-update-check.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.3 matchedPath = dist/backend/npm[redacted] matchedIdentity = npm:[redacted]:3.23.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend/npm-update-check.jsView on unpkg

dist/services/auto-relay.jsView file

•matchType = normalized_sha256 matchedPackage = @essentialai/cogent-bridge@3.23.9 matchedPath = dist/services/auto-relay.js matchedIdentity = npm:[redacted]:3.23.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/auto-relay.jsView on unpkg