Loading npm security reports…

@kingingwang/grok@1.0.41-51ac69f5: AI-agent control-surface risk | LPM Firewall

registry / @kingingwang/grok / 1.0.41-51ac69f5

@kingingwang/grok@1.0.41-51ac69f5

Bring Grok into your terminal

AI Security Review

scanned 15d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install of @kingingwang/grok runs a postinstall hook that writes a native binary and config into the Grok CLI home directory used by the official product, under a publisher that is not @xai-official.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install lifecycle postinstall.

Impact

A non-vendor package can replace the on-disk Grok CLI binary and installer settings in the user Grok home without a separate consent step.

Mechanism

postinstall.js decompresses the matching @kingingwang platform binary into ~/.grok/bin, rewrites ~/.grok/config.toml, and on npm replaces bin/grok with that native binary. The launcher still resolves @xai-official platform packages.

Policy narrative

Publishing this tree as @kingingwang/grok keeps an npm postinstall that the official CLI uses to stage its binary. On install the hook creates ~/.grok/bin, copies or brotli-decompresses a sibling native binary there, and rewrites ~/.grok/config.toml so cli.installer is npm. When the user agent is npm it also swaps the package bin/grok entry for that native file. The bootstrap script and README still name @xai-official/grok, so the write lands on the official Grok CLI control surface from a different scope.

AI rationale

Postinstall unconditionally installs a native binary and mutates config.toml in the official Grok home while the package identity is @kingingwang, not @xai-official. That is unconsented install-time takeover of a foreign AI CLI control surface.

Evidence

package.jsonbin/postinstall.jsbin/grok-bootstrap.js~/.grok/bin/grok

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"scripts": { "postinstall": "node bin/postinstall.js" },

High

Suspicious Lifecycle Evidence

npm postinstall always runs node bin/postinstall.js.

package.jsonView on unpkg · L21

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.32-aae58918 matchedPath = bin/postinstall.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.32-aae58918 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 830396dc7d8ac054 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kingingwang/grok@1.0.32-aae58918 matchedPath = bin/postinstall.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.32-aae58918 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.jsView on unpkg

22function defaultGrokHome() { const home = os.homedir(); try { return path.join(fs.realpathSync(home), '.grok'); } catch { return path.join(home, '.grok'); } } const GROK_HOME = process.env.GROK_HOME ?? defaultGrokHome(); const CANONICAL_DIR = path.join(GROK_HOME, 'bin');

High

Ai Review Evidence

That hook extracts a native binary into GROK_HOME/bin, which defaults to the user home .grok directory.

bin/postinstall.jsView on unpkg · L22

222const configDir = GROK_HOME; const configPath = path.join(configDir, 'config.toml'); let obj = {}; try { obj = TOML.parse(fs.readFileSync(configPath, 'utf8')); } catch { } obj.cli ??= {}; obj.cli.installer = 'npm';

High

Ai Review Evidence

It reads and rewrites GROK_HOME/config.toml, setting cli.installer to npm and optionally cli.npm_registry.

bin/postinstall.jsView on unpkg · L222

242if (npmRegistry) { obj.cli.npm_registry = npmRegistry; } fs.writeFileSync(configPath, TOML.stringify(obj), 'utf8');

High

Ai Review Evidence

It reads and rewrites GROK_HOME/config.toml, setting cli.installer to npm and optionally cli.npm_registry.

bin/postinstall.jsView on unpkg · L242

bin/grok-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.32-aae58918 matchedPath = bin/grok-bootstrap.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.32-aae58918 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/grok-bootstrap.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-42json

1{

2 "name": "@kingingwang/grok",

3 "version": "1.0.41-51ac69f5",

4 "description": "Bring Grok into your terminal",

5 "license": "Apache-2.0",

6 "bin": {

7 "grok": "bin/grok"

8 },

9 "files": [

10 "bin/"

11 ],

12 "os": [

13 "darwin",

14 "linux",

15 "win32"

16 ],

17 "cpu": [

18 "arm64",

19 "x64"

20 ],

21 "scripts": {

22 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

High

Suspicious Lifecycle Evidence

npm postinstall always runs node bin/postinstall.js.

package.jsonView on unpkg · L21

24 "publishConfig": {

25 "access": "public"

26 },

27 "engines": {

28 "node": ">=20"

29 },

30 "dependencies": {

31 "@iarna/toml": "^3.0.0"

32 },

33 "optionalDependencies": {

34 "@kingingwang/grok-darwin-arm64": "1.0.41-51ac69f5",

35 "@kingingwang/grok-darwin-x64": "1.0.41-51ac69f5",

36 "@kingingwang/grok-linux-arm64": "1.0.41-51ac69f5",

37 "@kingingwang/grok-linux-x64": "1.0.41-51ac69f5",

38 "@kingingwang/grok-win32-arm64": "1.0.41-51ac69f5",

39 "@kingingwang/grok-win32-x64": "1.0.41-51ac69f5"

40 }

41}

42

bin/postinstall.jsView file

Lines 2-42javascript

2// Runs once after npm install/update. Reads the grok binary from the

3// matching per-platform optional dependency (@kingingwang/grok-<platform>)

4// and installs it to ~/.grok/bin/ using versioned filenames:

5//

6// Unix: grok-<version> + grok (symlink)

7// Windows: grok-<version>.exe + grok.exe (copy)

8//

9// Versioned files ensure running processes are never disrupted on macOS

10// (replacing a binary that a running process has mmap'd causes SIGKILL

11// because the kernel can no longer verify the code signature).

bin/grok-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.32-aae58918 matchedPath = bin/grok-bootstrap.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.32-aae58918 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/grok-bootstrap.jsView on unpkg

Lines 202-262javascript

202 if (!writeVendorBinary(brotliPath, binaryPath, nativePath)) {

203 return;

204 }

205 try { fs.unlinkSync(tmp); } catch {}

206 fs.symlinkSync('./grok-native', tmp);

207 fs.renameSync(tmp, entryPath);

208 } catch (e) {

209 // Losing the link only costs latency; the node launcher still works.

210 console.error(`@kingingwang/grok: bin link not installed: ${e.message}`);

211 try { fs.unlinkSync(tmp); } catch {}

212 }

213}

214

215if (installBinary('grok', platformDir, `grok${EXE}`)) {

216 installBinLink(platformDir);

217}

218cleanupOldVersions('grok');

219cleanupOldVersions('grok-pager');

220

221// Write installer config

222const configDir = GROK_HOME;

223const configPath = path.join(configDir, 'config.toml');

224let obj = {};

225try { obj = TOML.parse(fs.readFileSync(configPath, 'utf8')); } catch { }

226obj.cli ??= {};

227obj.cli.installer = 'npm';

High

Ai Review Evidence

It reads and rewrites GROK_HOME/config.toml, setting cli.installer to npm and optionally cli.npm_registry.

bin/postinstall.jsView on unpkg · L222

228

229// Persist the npm registry so `grok update` and the launcher use the same one.

230const npmRegistry = process.env.GROK_NPM_REGISTRY

231 || (() => {

232 try {

233 const resolved = execSync(

234 'npm config get @kingingwang:registry',

235 { encoding: 'utf8', timeout: 5000 }

236 ).trim();

237 if (resolved && resolved !== 'undefined') return resolved;

238 } catch {}

239 return null;

240 })();

241

242if (npmRegistry) {

243 obj.cli.npm_registry = npmRegistry;

244}

245

246fs.writeFileSync(configPath, TOML.stringify(obj), 'utf8');

High

Ai Review Evidence

It reads and rewrites GROK_HOME/config.toml, setting cli.installer to npm and optionally cli.npm_registry.

bin/postinstall.jsView on unpkg · L242

247

248// Shell completions: print setup hints (no silent shell config mutation).

249// Set GROK_INSTALL_COMPLETIONS=1 to auto-generate to ~/.grok/completions.

250const GROK_PATH = path.join(CANONICAL_DIR, `grok${EXE}`);

251if (process.env.GROK_INSTALL_COMPLETIONS === '1' && !IS_WINDOWS) {

252 try {

253 const { spawnSync } = require('child_process');

254 const completionsDir = path.join(GROK_HOME, 'completions');

255 const bashPath = path.join(completionsDir, 'bash', 'grok.bash');

256 const zshPath = path.join(completionsDir, 'zsh', '_grok');

257 fs.mkdirSync(path.dirname(bashPath), { recursive: true });

258 fs.mkdirSync(path.dirname(zshPath), { recursive: true });

259 const bashRes = spawnSync(GROK_PATH, ['completions', 'bash'], { encoding: 'utf8' });

260 if (bashRes.status === 0) fs.writeFileSync(bashPath, bashRes.stdout);

261 const zshRes = spawnSync(GROK_PATH, ['completions', 'zsh'], { encoding: 'utf8' });

262 if (zshRes.status === 0) fs.writeFileSync(zshPath, zshRes.stdout);