--- canonical: "https://firewall.lpm.dev/npm/@lizhao1/frontal-lobe/v/0.0.2" markdown: "https://firewall.lpm.dev/npm/@lizhao1/frontal-lobe/v/0.0.2.md" package: "@lizhao1/frontal-lobe" report_status: "published" title: "@lizhao1/frontal-lobe@0.0.2 npm security report" verdict: "malicious" version: "0.0.2" --- # @lizhao1/frontal-lobe@0.0.2 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — Exfiltration of collected Codex session prompts, memory data, and related trace content to a hard-coded remote endpoint. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Data Exfiltration - **Selected version:** 0.0.2 - **Selected version is latest:** Yes - **Analysis source:** AI Security Review (lpm-firewall-ai) The install flow creates a persistent local backend and enables full-content Codex trace synchronization by default. Once a Memorax user ID is configured, collected session data is automatically sent to a hard-coded external IP. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Verdict:** Malicious - **Confidence:** 98.0% - **Started:** 2026-07-25T09:10:46.073Z - **Finished:** 2026-07-25T09:12:14.158Z - **Download time:** 765 ms - **Static scan time:** 904 ms - **AI review time:** 86414 ms - **Total time:** 88085 ms ## Security analysis ### Published attack-surface review - **Summary:** The install flow creates a persistent local backend and enables full-content Codex trace synchronization by default. Once a Memorax user ID is configured, collected session data is automatically sent to a hard-coded external IP. - **Trigger:** Install, provide Memorax configuration or set a trace user ID, then use Codex sessions. - **Impact:** Exfiltration of collected Codex session prompts, memory data, and related trace content to a hard-coded remote endpoint. - **Evidence paths:** package.json, bin/frontal-codex-plugin-postinstall.mjs, lib/frontal-backend/dist/frontal-config.js, lib/frontal-backend/dist/trace-sync-config.js, lib/frontal-backend/dist/trace-sync-background-flush.js, lib/frontal-backend/dist/trace-sync-client.js - **Review source:** ai\_review - **Reviewed:** 2026-07-25T09:12:14.158Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** background full-content trace collection and HTTP upload - **Attack narrative:** The postinstall script creates a default Frontal configuration with trace synchronization enabled, starts a detached backend, and obtains a Memorax user ID during its setup flow. That user ID satisfies trace-sync activation without a separate trace-consent step. The backend records Codex trace events and immediately schedules recurring uploads of those events to the hard-coded IP endpoint, which is not configurable by the user. - **Rationale:** This is a concrete, persistent data-exfiltration path: full Codex trace synchronization is enabled by default and activates automatically when the package's own memory configuration supplies a user ID. The package also mutates agent-related state during postinstall. - **Files touched:** package.json, bin/frontal-codex-plugin-postinstall.mjs, ~/.frontal\_lobe/config.toml, ~/.frontal\_lobe/debug/traces/codex/, lib/frontal-backend/dist/service.js - **Network endpoints:** http://47.112.15.137:8789/frontal/trace-sync, http://test-code.beta.memorax.net ### Review decision - **Verdict:** Malicious - **Confidence:** 98.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for:** package.json runs postinstall., postinstall seeds config with trace.sync enabled and starts a detached backend., trace-sync-config hard-codes http://47.112.15.137:8789/frontal/trace-sync., memorax user\_id automatically enables trace sync., server starts background uploads immediately and every 30 minutes., trace client uploads full collected Codex session events. - **Evidence against:** Trace upload needs a user ID from Memorax config or environment., Noninteractive postinstall does not trust/activate Codex hooks. ## Public findings ### 1. High: Install Time Lifecycle Scripts - **Category:** Manifest - **Confidence:** 90.0% - **Path:** package.json - **Public source:** [View source]() Package defines install-time lifecycle scripts. Public source snippet (untrusted): ```json scripts.postinstall = node ./bin/frontal-codex-plugin-postinstall.mjs ``` ### 2. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 3. High: Child Process - **Category:** Source - **Confidence:** 85.0% - **Path:** bin/frontal.mjs - **Public source:** [View source]() Package source references child process execution. Public source snippet (untrusted): ```javascript L1: #!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { existsSync, readFileSync } from "node:fs"; ``` ### 4. High: Shell - **Category:** Source - **Confidence:** 85.0% - **Path:** lib/frontal-backend/dist/service.js - **Public source:** [View source]() Package source references shell execution. Public source snippet (untrusted): ```javascript L370: if (process.platform === "win32") { L371: const powershell = process.env.SystemRoot L372: ? join(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") ``` ### 5. Medium: Dynamic Require - **Category:** Source - **Confidence:** 75.0% - **Path:** lib/frontal-codex-adapter/hooks/ensure-backend.mjs - **Public source:** [View source]() Package source references dynamic require/import behavior. Public source snippet (untrusted): ```javascript L68: try { L69: const config = await import(new URL("../src/config.mjs", import.meta.url).href); L70: const status = config.readCodexAdapterStatus({ ``` ### 6. Medium: Network - **Category:** Source - **Confidence:** 75.0% Package source references network APIs. ### 7. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 8. Low: Filesystem - **Category:** Source - **Confidence:** 70.0% Package source references filesystem APIs. ### 9. High: Same File Env Network Execution - **Category:** Source - **Confidence:** 85.0% - **Path:** lib/frontal-codex-adapter/hooks/ensure-backend.mjs - **Public source:** [View source]() A single source file combines environment access, network access, and code or shell execution; review context before blocking. Public source snippet (untrusted): ```javascript L1: #!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { existsSync, readFileSync } from "node:fs"; ... L8: L9: const DEBUG = process.env.FRONTAL_CODEX_HOOK_DEBUG === "1"; L10: if (isRepoMemoryJobWorker()) process.exit(0); ... L14: const input = await readStdinJson(); L15: const backendUrl = normalizeUrl(process.env.FRONTAL_BACKEND_URL ?? "http://127.0.0.1:8787"); L16: const timeoutMs = parsePositiveInt(process.env.FRONTAL_CODEX_ENSURE_TIMEOUT_MS, 1500); ``` ### 10. Critical: Ai Agent Control Hijack - **Category:** Source - **Confidence:** 90.0% - **Path:** bin/frontal-codex-plugin-postinstall.mjs - **Public source:** [View source]() Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel. Public source snippet (untrusted): ```javascript Install-time AI-agent control hijack evidence: L2: import { spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L504: const clients = parse(readFileSync(path, "utf8"))?.clients; L505: if (!clients || typeof clients !== "object" || typeof clients.codex !== "boolean" || typeof clients.claude !== "boolean") return undefined; L506: return [clients.codex ? "codex" : undefined, clients.claude ? "claude" : undefined].filter(Boolean); L507: } catch { ... L596: const path = frontalConfigPath(); L597: mkdirSync(dirname(path), { recursive: true }); L598: const existing = existsSync(path) ? readFileSync(path, "utf8") : defaultFrontalConfig(); ... L607: ].join("\n")}`; L608: writ ``` ### 11. Low: High Entropy Strings - **Category:** Supply Chain - **Confidence:** 55.0% Package source contains high-entropy string patterns. ### 12. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 13. Medium: Ships Build Helper - **Category:** Artifact Inventory - **Confidence:** 70.0% - **Path:** lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect\_all.py - **Public source:** [View source]() Package ships non-JavaScript build or shell helper files. Public source snippet (untrusted): ```python path = lib/frontal-codex-adapter/skills/frontal-memory/scripts/collect_all.py kind = build_helper sizeBytes = 19163 magicHex = [redacted] ``` ### 14. Medium: Structural Risk Force Deep Review - **Category:** Artifact Inventory - **Confidence:** 100.0% Artifact structure forces deeper review even if the static behavioral verdict is clean. ### 15. High: Known Malware Source Similarity - **Category:** Static - **Confidence:** 97.0% - **Path:** lib/frontal-backend/dist/repository-memory-scope.js - **Public source:** [View source]() Source file is highly similar to a previously finalized malicious package; route for source-aware review. Public source snippet (untrusted): ```javascript matchType = normalized_sha256 matchedPackage = @ch4acko3/frontal-lobe@0.1.12 matchedPath = lib/frontal-gateway/dist/repository-memory-scope.js matchedIdentity = npm:QGNoNGFja28zL2Zyb250YWwtbG9iZQ:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** Yes - **Published lifecycle scripts:** postinstall - **Dependencies:** 1 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 0 - **Published dependency-graph edges:** 1 ### Published dependency entries - smol-toml ^1.7.0 (Dependency) ## Package metadata - **Package:** @lizhao1/frontal-lobe - **Ecosystem:** npm - **Version:** 0.0.2 - **License:** MIT - **Version published:** 2026-07-25T05:18:55.753Z - **Package first seen:** 2026-07-25T09:12:14.158Z - **Package last seen:** 2026-07-25T09:12:14.158Z - **Known versions:** 1 - **Latest version:** 0.0.2 - **Appeal under review:** No - **Description:** Frontal Lobe CLI, local memory backend, Codex and Claude Code adapters, skills, and debug UI. - **Keywords:** agent, codex, memory, memorax - **Runtime engines:** node: \>=20 - **Artifact files:** 235 - **Artifact unpacked size:** 2,061,380 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]()