registry / Data exfiltration / @lizhao1/frontal-lobe

@lizhao1/frontal-lobe

Frontal Lobe CLI, local memory backend, Codex and Claude Code adapters, skills, and debug UI.

This report shows the evidence for @lizhao1/frontal-lobe@0.0.2, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete, persistent data-exfiltration path: full Codex trace synchronization is enabled by default and activates automatically when the package's own memory configuration supplies a user ID. The package also mutates agent-related state during postinstall.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Install, provide Memorax configuration or set a trace user ID, then use Codex sessions.

Impact

Exfiltration of collected Codex session prompts, memory data, and related trace content to a hard-coded remote endpoint.

Mechanism

background full-content trace collection and HTTP upload

Attack narrative

The postinstall script creates a default Frontal configuration with trace synchronization enabled, starts a detached backend, and obtains a Memorax user ID during its setup flow. That user ID satisfies trace-sync activation without a separate trace-consent step. The backend records Codex trace events and immediately schedules recurring uploads of those events to the hard-coded IP endpoint, which is not configurable by the user.

AI rationale

Evidence

package.jsonbin/frontal-codex-plugin-postinstall.mjslib/frontal-backend/dist/frontal-config.jslib/frontal-backend/dist/trace-sync-config.jslib/frontal-backend/dist/trace-sync-background-flush.jslib/frontal-backend/dist/trace-sync-client.js~/.frontal_lobe/config.toml~/.frontal_lobe/debug/traces/codex/lib/frontal-backend/dist/service.js

Network endpoints2

47.112.15.137:8789/frontal/trace-sync

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs postinstall.
postinstall seeds config with trace.sync enabled and starts a detached backend.
trace-sync-config hard-codes http://47.112.15.137:8789/frontal/trace-sync.
memorax user_id automatically enables trace sync.
server starts background uploads immediately and every 30 minutes.
trace client uploads full collected Codex session events.

Evidence against

Trace upload needs a user ID from Memorax config or environment.
Noninteractive postinstall does not trust/activate Codex hooks.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 154 file(s), 1.10 MB of source, external domains: 127.0.0.1, 47.112.15.137, test-code.beta.memorax.net

Source & flagged code

8 flagged

package.jsonView file

Lines 21-44json

21 "bin": {

22 "frontal": "bin/frontal.mjs",

23 "frontal-backend": "bin/frontal-backend.mjs",

24 "frontal-claude": "bin/frontal-claude.mjs",

25 "frontal-codex": "bin/frontal-codex.mjs"

26 },

27 "files": [

28 "bin",

29 "docs",

30 "examples",

31 "lib",

32 "README.md"

33 ],

34 "engines": {

35 "node": ">=20"

36 },

37 "dependencies": {

38 "smol-toml": "^1.7.0"

39 },

40 "scripts": {

41 "postinstall": "node ./bin/frontal-codex-plugin-postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

42 }

43}

bin/frontal.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/frontal.mjsView on unpkg · L1

4import { homedir } from "node:os";

lib/frontal-backend/dist/service.jsView file

Lines 350-390javascript

350 if (!Number.isSafeInteger(state.port) || state.port <= 0 || state.port > 65535)

351 return false;

352

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { existsSync, readFileSync } from "node:fs";

4import { homedir } from "node:os";

5import { basename, delimiter, dirname, join }

bin/frontal-codex-plugin-postinstall.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

4import { homedir } from "node:os";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView file

•path = lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.py kind = build_helper sizeBytes = 19163 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView on unpkg

lib/frontal-backend/dist/repository-memory-scope.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.12 matchedPath = lib/frontal-gateway/dist/repository-memory-scope.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-backend/dist/repository-memory-scope.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/frontal-codex-plugin-postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/frontal.mjsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/frontal.mjsView on unpkg · L1

lib/frontal-backend/dist/service.jsView file

370if (process.platform === "win32") { L371: const powershell = process.env.SystemRoot L372: ? join(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")

Findings

1 Critical5 High5 Medium4 Low

CriticalAi Agent Control Hijackbin/frontal-codex-plugin-postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/frontal.mjs

HighShelllib/frontal-backend/dist/service.js

HighSame File Env Network Executionlib/frontal-codex-adapter/hooks/ensure-backend.mjs

HighKnown Malware Source Similaritylib/frontal-backend/dist/repository-memory-scope.js

MediumDynamic Requirelib/frontal-codex-adapter/hooks/ensure-backend.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperlib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.py

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @lizhao1/frontal-lobe@0.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing @lizhao1/frontal-lobe@0.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-25 09:12:14.158Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.0.2latestshownMaliciousData ExfiltrationBlockPublishedJul 25, 2026, 5:18 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @lizhao1

Other data exfiltration packages

Behavioral surface

Related packages

More from @lizhao1

Other data exfiltration packages

Source & flagged code