Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@itsshadowai/refinery@0.1.1: Suspicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / @itsshadowai/refinery / 0.1.1

@itsshadowai/refinery@0.1.1

Refinery — Codex-first memory review CLI.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No unconsented install-time attack behavior was found. An explicit `refinery init` installs the package's bundled Codex skill, and explicit live-review commands transmit review inputs to the configured model service.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `refinery init`, `refinery review`, or Coral console commands.

Impact

Installs a package-owned agent skill and can disclose user-selected review content to the configured model endpoint.

Mechanism

Explicit first-party skill setup and model-review client

Rationale

Source inspection found no malicious lifecycle behavior, exfiltration chain, persistence, or destructive action. Per policy, the explicit first-party Codex skill installation warrants a warning classification.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.jsdist/core/credentials.jsdist/core/model-client.jsdist/coral/review-conductor.jsskills/refinery/SKILL.md~/.codex/skills/refinery/~/.refinery/credentials/coral-api-key

Network endpoints2

llm.coralcloud.ai/deepseek/v1localhost:5555

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`refinery init` copies bundled skill into `CODEX_HOME/skills/refinery`; `--force` deletes that skill directory first.
Live review sends supplied memory-review content and API key to configured model endpoint.
`console`/Coral paths can run `npx -y <coralPackage> server start` after an explicit command.

Evidence against

`postinstall` only writes an installation help message to stderr.
No lifecycle hook writes files, invokes a shell, or makes network requests.
Codex skill installation and credential storage require explicit CLI commands.
Credential file is written mode 0600; no source path exports local credentials independently.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 232 KB of source, external domains: llm.coralcloud.ai

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/coral/review-conductor.jsView file

1import { spawn } from "node:child_process"; L2: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/coral/review-conductor.jsView on unpkg · L1

376].filter((entry) => Boolean(entry)); L377: const child = spawn("npx", ["-y", args.coralPackage, "server", "start"], { L378: cwd: repoRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/coral/review-conductor.jsView on unpkg · L376

dist/cli.jsView file

80try { L81: mod = await import(__rewriteRelativeImportExtension(pathToFileURL(resolved).href)); L82: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L80

coral/agents/run-worker.shView file

•path = coral/agents/run-worker.sh kind = build_helper sizeBytes = 541 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

coral/agents/run-worker.shView on unpkg

Findings

4 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/coral/review-conductor.js

HighShell

HighRuntime Package Installdist/coral/review-conductor.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercoral/agents/run-worker.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

87%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainersitsshadowai

Version0.3.1

PublishedJul 3, 2026

LicenseMIT

Dependencies3

Integrityverified

Package size98.0 KB

Files103

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → refinery

Runtimenode >=22

Artifact492 KB · 103 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 16-53json

16 "access": "public"

17 },

18 "files": [

19 "dist",

20 "coral",

21 "skills",

22 "scripts/postinstall.mjs",

23 "README.md",

24 "LICENSE",

25 "package.json"

26 ],

27 "bin": {

28 "refinery": "dist/cli.js"

29 },

30 "scripts": {

31 "build": "tsc -p tsconfig.build.json && node scripts/mark-bin-executable.mjs",

32 "cli": "node src/cli.ts",

33 "mcp": "node src/mcp.ts",

34 "coral:worker": "node src/coral/worker.ts",

35 "coral:smoke": "node src/coral/smoke.ts",

36 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "test": "node --test $(find src -name '*.test.ts' -print)",

38 "typecheck": "tsc -p tsconfig.json --noEmit"

39 },

40 "engines": {

41 "node": ">=22"

42 },

43 "dependencies": {

44 "@ai-sdk/openai": "^3.0.67",

45 "@modelcontextprotocol/sdk": "^1.29.0",

46 "zod": "^4.4.3"

47 },

48 "devDependencies": {

49 "@types/node": "^26.0.1",

50 "typescript": "^6.0.3"

51 }

52}

53

dist/coral/review-conductor.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/coral/review-conductor.jsView on unpkg · L1

3import os from "node:os";

4

dist/cli.jsView file

Lines 60-100javascript

60}

61function copyDirectory(src, dest) {

62 fs.mkdirSync(dest, { recursive: true });

63 for (const entry of fs.readdirSync(src, { withFileTypes:

coral/agents/run-worker.shView file

•path = coral/agents/run-worker.sh kind = build_helper sizeBytes = 541 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

coral/agents/run-worker.shView on unpkg

import

path

from

"node:path"

;

5import { setTimeout as sleep } from "node:timers/promises";

6import { fileURLToPath } from "node:url";

7import { allMessages, buildCoralSessionRequest, classifyAgentReadiness, closeSession, createSession, getExtended, getLocalAgent, puppetCreateThread, puppetSendMessage, waitForAgentsReady, } from "./client.js";

8import { refineryCoralAgentNames, refineryCoralAuthKey, refineryCoralConfigPath, refineryCoralModelDefaults, refineryCoralPort, } from "./definitions.js";

9import { defaultReviewTopology } from "./topology.js";

10import { memoryMaintenanceActions, refineryReviewSchemaVersion, } from "../core/adapter.js";

11import { loadLocalEnv, parseModelMaxTokens } from "../env.js";

12import { applyErrorContext, asRefineryError, RefineryError, } from "../core/errors.js";

13import { writeReviewArtifactManifest, reviewStepOrder } from "../core/artifacts.js";

14import { buildDeliberationArtifacts, claimCardsForCritique, } from "../core/deliberation.js";

15import { deliverReviewSink, writeReviewFailureStatus, } from "../core/review.js";

16import { defaultReviewIntent, describeReviewIntent } from "../core/intents.js";

17const DEFAULT_SOURCE_LIMIT = 3;

18const DEFAULT_SOURCE_CHAR_LIMIT = 6000;

19const DEFAULT_PIPELINE_WAIT_TIMEOUT_MS = 180_000;

20const DEFAULT_DEBATE_CRITIQUE_WAIT_TIMEOUT_MS = 600_000;

21const DEFAULT_WAIT_INTERVAL_MS = 1_500;

Lines 356-396javascript

356 }

357}

358async function waitForServer(apiUrl, authKey, timeoutMs) {

359 const deadline = Date.now() + timeoutMs;

360 while (Date.now() < deadline) {

361 if (await isServerReady(apiUrl, authKey))

362 return true;

363 await sleep(1_000);

364 }

365 return false;

366}

367function startCoralServer(args) {

368 const configAbs = path.isAbsolute(args.configPath) ? args.configPath : path.resolve(repoRoot, args.configPath);

369 const nodeBin = node24Bin();

370 const nodeDir = nodeBin ? path.dirname(nodeBin) : null;

371 const javaHome = coralJavaHome();

372 const pathEntries = [

373 nodeDir,

374 javaHome ? path.join(javaHome, "bin") : null,

375 process.env.PATH,

376 ].filter((entry) => Boolean(entry));

377 const child = spawn("npx", ["-y", args.coralPackage, "server", "start"], {

378 cwd: repoRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/coral/review-conductor.jsView on unpkg · L376

379 env: {

380 ...process.env,

381 CONFIG_FILE_PATH: configAbs,

382 REFINERY_NODE_BIN: process.env.REFINERY_NODE_BIN ?? nodeBin ?? undefined,

383 JAVA_HOME: process.env.JAVA_HOME ?? javaHome ?? undefined,

384 PATH: pathEntries.join(":"),

385 },

386 });

387 child.stdout.on("data", (chunk) => appendLogLines(args.logs, "coral:stdout", chunk));

388 child.stderr.on("data", (chunk) => appendLogLines(args.logs, "coral:stderr", chunk));

389 child.on("exit", (code, signal) => args.logs.push(`[coral:exit] code=${code ?? "null"} signal=${signal ?? "null"}`));

390 return child;

391}

392async function stopStartedServer(child) {

393 if (!child || child.exitCode !== null || child.signalCode !== null)

394 return;

395 child.kill("SIGTERM");

396 await Promise.race([

true

})) {

64 const sourcePath = path.join(src, entry.name);

65 const destPath = path.join(dest, entry.name);

66 if (entry.isDirectory()) {

67 copyDirectory(sourcePath, destPath);

68 }

69 else if (entry.isFile()) {

70 fs.copyFileSync(sourcePath, destPath);

71 }

72 }

73}

74function defaultRunId(prefix = "review") {

75 return `${prefix}-${new Date().toISOString().replace(/[:.]/g, "-")}`;

76}

77async function loadSink(spec) {

78 const resolved = path.resolve(spec);

79 let mod;

80 try {

81 mod = await import(__rewriteRelativeImportExtension(pathToFileURL(resolved).href));

82 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L80

83 catch (error) {

84 throw new RefineryError("SINK_LOAD_FAILED", error instanceof Error ? error.message : String(error), { phase: "sink" });

85 }

86 const sink = mod.sink ?? mod.default;

87 if (!sink || typeof sink !== "object" || !("url" in sink) || typeof sink.url !== "string") {

88 throw new RefineryError("SINK_LOAD_FAILED", "sink module must export { sink: { url, headers? } } or default { url, headers? }", { phase: "sink" });

89 }

90 return sink;

91}

92function parseOptionArgs(args, options) {

93 try {

94 return parseArgs({

95 args,

96 options,

97 allowPositionals: false,

98 }).values;

99 }

100 catch (error) {