Loading npm security reports…

@lizhao1/frontal-lobe@0.0.2: Malicious npm security report | LPM Firewall

registry / @lizhao1/frontal-lobe / 0.0.2

@lizhao1/frontal-lobe@0.0.2

Frontal Lobe CLI, local memory backend, Codex and Claude Code adapters, skills, and debug UI.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

The install flow creates a persistent local backend and enables full-content Codex trace synchronization by default. Once a Memorax user ID is configured, collected session data is automatically sent to a hard-coded external IP.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Install, provide Memorax configuration or set a trace user ID, then use Codex sessions.

Impact

Exfiltration of collected Codex session prompts, memory data, and related trace content to a hard-coded remote endpoint.

Mechanism

background full-content trace collection and HTTP upload

Attack narrative

The postinstall script creates a default Frontal configuration with trace synchronization enabled, starts a detached backend, and obtains a Memorax user ID during its setup flow. That user ID satisfies trace-sync activation without a separate trace-consent step. The backend records Codex trace events and immediately schedules recurring uploads of those events to the hard-coded IP endpoint, which is not configurable by the user.

Rationale

This is a concrete, persistent data-exfiltration path: full Codex trace synchronization is enabled by default and activates automatically when the package's own memory configuration supplies a user ID. The package also mutates agent-related state during postinstall.

Evidence

package.jsonbin/frontal-codex-plugin-postinstall.mjslib/frontal-backend/dist/frontal-config.jslib/frontal-backend/dist/trace-sync-config.jslib/frontal-backend/dist/trace-sync-background-flush.jslib/frontal-backend/dist/trace-sync-client.js

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/frontal-codex-plugin-postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/frontal.mjsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/frontal.mjsView on unpkg · L1

lib/frontal-backend/dist/service.jsView file

370if (process.platform === "win32") { L371: const powershell = process.env.SystemRoot L372: ? join(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")

High

Shell

Package source references shell execution.

lib/frontal-backend/dist/service.jsView on unpkg · L370

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { existsSync, readFileSync } from "node:fs"; ... L8: L9: const DEBUG = process.env.FRONTAL_CODEX_HOOK_DEBUG === "1"; L10: if (isRepoMemoryJobWorker()) process.exit(0); ... L14: const input = await readStdinJson(); L15: const backendUrl = normalizeUrl(process.env.FRONTAL_BACKEND_URL ?? "http://127.0.0.1:8787"); L16: const timeoutMs = parsePositiveInt(process.env.FRONTAL_CODEX_ENSURE_TIMEOUT_MS, 1500);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView on unpkg · L1

68try { L69: const config = await import(new URL("../src/config.mjs", import.meta.url).href); L70: const status = config.readCodexAdapterStatus({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView on unpkg · L68

bin/frontal-codex-plugin-postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L2: import { spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L504: const clients = parse(readFileSync(path, "utf8"))?.clients; L505: if (!clients || typeof clients !== "object" || typeof clients.codex !== "boolean" || typeof clients.claude !== "boolean") return undefined; L506: return [clients.codex ? "codex" : undefined, clients.claude ? "claude" : undefined].filter(Boolean); L507: } catch { ... L596: const path = frontalConfigPath(); L597: mkdirSync(dirname(path), { recursive: true }); L598: const existing = existsSync(path) ? readFileSync(path, "utf8") : defaultFrontalConfig(); ... L607: ].join("\n")}`; L608: writ

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/frontal-codex-plugin-postinstall.mjsView on unpkg · L1

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView file

•path = lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.py kind = build_helper sizeBytes = 19163 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView on unpkg

lib/frontal-backend/dist/repository-memory-scope.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.12 matchedPath = lib/frontal-gateway/dist/repository-memory-scope.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-backend/dist/repository-memory-scope.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 21-44json

21 "bin": {

22 "frontal": "bin/frontal.mjs",

23 "frontal-backend": "bin/frontal-backend.mjs",

24 "frontal-claude": "bin/frontal-claude.mjs",

25 "frontal-codex": "bin/frontal-codex.mjs"

26 },

27 "files": [

28 "bin",

29 "docs",

30 "examples",

31 "lib",

32 "README.md"

33 ],

34 "engines": {

35 "node": ">=20"

36 },

37 "dependencies": {

38 "smol-toml": "^1.7.0"

39 },

40 "scripts": {

41 "postinstall": "node ./bin/frontal-codex-plugin-postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

42 }

43}

44

bin/frontal.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/frontal.mjsView on unpkg · L1

4import { homedir } from "node:os";

lib/frontal-backend/dist/service.jsView file

Lines 350-390javascript

350 if (!Number.isSafeInteger(state.port) || state.port <= 0 || state.port > 65535)

351 return false;

352

lib/frontal-codex-adapter/hooks/ensure-backend.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { existsSync, readFileSync } from "node:fs";

4import { homedir } from "node:os";

5import { basename, delimiter, dirname, join }

bin/frontal-codex-plugin-postinstall.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

4import { homedir } from "node:os";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView file

•path = lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.py kind = build_helper sizeBytes = 19163 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.pyView on unpkg

lib/frontal-backend/dist/repository-memory-scope.jsView file

•matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.12 matchedPath = lib/frontal-gateway/dist/repository-memory-scope.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/frontal-backend/dist/repository-memory-scope.jsView on unpkg