@oked/codex@0.6.25
OKed for Codex CLI. A PreToolUse hook that holds risky tool calls for a human decision.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s intended approval flow and explicit setup appear legitimate, but the automatically triggered heartbeat sends an identifying hostname as undisclosed runtime telemetry. This warrants a warning, not a publish block.
Static reason
No blocking static signals were detected.
Trigger
After a user runs oked-codex init and pairs the device, the Codex hook sends a heartbeat when handling a tool call, at most once per day per backend and key.
Impact
The service can associate a machine hostname with an active paired installation; this identifying runtime telemetry is not described in the package README.
Mechanism
The SDK posts the hostname and bearer API key to the configured backend’s /api/v1/heartbeat endpoint and stores heartbeat throttle stamps locally.
AI rationale
The package’s intended approval flow and explicit setup appear legitimate, but the automatically triggered heartbeat sends an identifying hostname as undisclosed runtime telemetry. This warrants a warning, not a publish block.
Evidence
dist/hook.js.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/0/npm-linux/dist/decide.js.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/1/npm-linux/dist/index.js.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/1/npm-linux/dist/config.js~/.oked/heartbeat.json
Network endpoints1
api.oked.ai/api/v1/heartbeat (default; backend URL configurable)
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The hook’s decision path calls a presence heartbeat before returning for safe or warning actions.
- The heartbeat sends the machine hostname with a bearer API key to the configured backend’s /api/v1/heartbeat endpoint; the default backend is https://api.oked.ai.
- The heartbeat is throttled to once per day per backend and key, but runs automatically when the hook handles a tool call.
- The package has no install hook; its only lifecycle script is prepublishOnly.
Evidence against
- The project hook is installed through the documented, explicit oked-codex init command.
- Approval requests and heartbeat traffic go to the OKed backend by default, and the backend URL is configurable.
- The heartbeat reports a hostname for retention analytics; the inspected source shows no unrelated collector or credential harvesting.
Behavioral surface
EnvironmentVarsFilesystem
UrlStrings
Source & flagged code
6 flagged.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/0/npm-linux/dist/decide.jsView file
62// Presence ping (throttled to once/day on disk, never throws). Fired before
// the safe/warning fast-path return so installs that only ever run safe
// actions still register for retention. Bounded by the 3s internal timeout,
// and only the once/day send actuall
Medium
Ai Review Evidence
The hook’s decision path calls a presence heartbeat before returning for safe or warning actions.
.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/0/npm-linux/dist/decide.jsView on unpkg · L62.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/1/npm-linux/dist/index.jsView file
324const res = await fetch(`${this.config.backendUrl}/api/v1/heartbeat`, {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: `Bearer ${this.config.apiKey}`,
},
Findings
7 Medium4 Low
MediumEnvironment Vars
MediumAi Review Evidence.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/0/npm-linux/dist/decide.js
MediumAi Review Evidence.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/1/npm-linux/dist/index.js
MediumAi Review Evidence.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/1/npm-linux/dist/index.js
MediumAi Review Evidence.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/1/npm-linux/dist/index.js
MediumAi Review Evidence.lpm-dependency-evidence-aae3f922-c506-4c6a-9d6c-d9aae69d8eeb/1/npm-linux/dist/index.js
MediumSuspicious Lifecycle Evidencepackage.json
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @oked/codex@0.6.25.
See all versions of @oked/codex for other recorded verdicts.
- Review the evidence and your use of @oked/codex@0.6.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.