registry / Install hook abuse / @ornexus/neocortex

@ornexus/neocortex

Neocortex v4.60.51 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code

This report shows the evidence for @ornexus/neocortex@4.60.51. 21 of 41 known versions are blocked or flagged. The newest version, 4.60.52, is flagged. See all versions.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The automatic lifecycle chain modifies a foreign AI-agent environment and installs MCP capabilities without an explicit setup command or target choice. This meets the install-control-surface blocking rule.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm global installation runs the postinstall hook.

Impact

The package can alter a foreign AI-agent configuration and introduce externally sourced tool capabilities during dependency installation.

Mechanism

The hook launches the shell installer with automatic confirmation. The installer defaults to Claude Code, creates a home-directory agent location, and registers MCP servers, including one supplied with existing provider credentials.

Attack narrative

Installing this package globally triggers postinstall. That hook silently launches the installer with automatic confirmation. The installer defaults to Claude Code, creates agent files under the user home directory, and configures user-scope MCP servers. It also passes existing OpenAI or Anthropic API-key environment variables into a browser-use MCP registration. This is an unconsented lifecycle mutation of a broad AI-agent control surface.

AI rationale

Evidence

package.jsonpostinstall.jsinstall.sh$HOME/.claude$HOME/.claude/agents/neocortex$HOME/.neocortex

Network endpoints1

mcp.context7.com/mcp

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package declares an npm postinstall lifecycle hook.
On global installation, the lifecycle handler automatically runs its installer.
The installer is invoked with automatic confirmation and no project prompt.
When no target is chosen, the installer defaults to Claude Code.
The installer creates a user Claude agent directory.
The installer adds user-scope Claude MCP integrations and forwards existing AI-provider environment credentials to one integration.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 158 file(s), 1.57 MB of source, external domains: aka.ms, api.neocortex.sh, github.com, neocortex.sh, schemas.microsoft.com, www.apple.com

Source & flagged code

24 flagged

package.jsonView file

Lines 82-122json

82 "!packages/client/dist/**/*.js.map",

83 "!packages/client/dist/**/*.d.ts.map",

84 "targets-stubs/",

85 "dist/sbom.cdx.json"

86 ],

87 "scripts": {

88 "test": "node scripts/test-root.mjs",

89 "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs && node scripts/verify-compiled-invoke-signature.cjs",

90 "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",

91 "build:client": "npm run build -w packages/client",

92 "build:shared": "npm run build -w packages/shared",

93 "build:server": "npm run build -w packages/server",

94 "command-registry:generate": "npm run build:shared && node scripts/generate-command-registry.mjs",

95 "command-registry:check": "npm run build:shared && node scripts/generate-command-registry.mjs --check",

96 "public-projections:generate": "npm run build:shared && node scripts/generate-command-registry.mjs && npm run build:shared && npm run build:server && node scripts/generate-public-catalog-projections.mjs",

97 "public-projections:check": "npm run build:shared && node scripts/generate-command-registry.mjs --check && npm run build:server && node scripts/generate-public-catalog-projections.mjs --check",

98 "command-registry:migrate-project": "node scripts/migrate-command-registry-project-id.mjs",

99 "command-registry:migrate-claim-scope": "node scripts/migrate-epic-claim-scope.mjs",

100 "test:p205-registry": "vitest run tests/p205-registry",

101 "test:installed-migration": "node scripts/test-installed-migration-smoke.mjs",

102 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L102

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L102

103 "sync": "node sync-version.js",

104 "validate": "node scripts/validate-pre-publish.js",

105 "validate:pre-publish": "node scripts/validate-pre-publish.js",

106 "validate:client-artifacts": "node scripts/validate-client-artifacts.mjs",

107 "validate:bash": "bash scripts/validate-pre-publish.sh",

108 "admin:dev": "cd admin && npm run dev",

109 "admin:build": "cd admin && npm run build",

110 "admin:test": "cd admin && npm run test",

111 "admin:lint": "cd admin && npm run lint",

112 "portal:dev": "cd portal && npm run dev",

113 "portal:build": "cd portal && npm run build",

114 "portal:test": "cd portal && npm run test",

115 "storybook": "storybook dev -p 6006",

116 "storybook:build": "storybook build --output-dir storybook-static",

117 "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",

118 "remotion:studio": "remotion studio remotion/index.ts --public-dir=landing/public",

119 "remotion:typecheck": "tsc --noEmit -p remotion/tsconfig.json",

120 "remotion:render:release": "node scripts/render-release-reel.mjs video",

121 "remotion:still:release": "node scripts/render-release-reel.mjs still",

122 "remotion:still:release:safe-zone": "node scripts/render-release-reel.mjs safe-zone",

postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Neocortex - Postinstall Hook

5 *

6 * For global installs: auto-runs the installer in quiet/auto mode.

7 * For local installs: prints usage message.

8 *

9 * NEVER fails npm install -- always exits 0.

10 *

11 * Epic 62 - GAP 6

12 */

install.jsView file

Lines 124-164javascript

124 }

125 return filtered;

126}

127

128function isAutoYes() {

129 return args.includes('-y') || args.includes('--yes'

targets-stubs/lib/managed-config-merge.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/*

3 * Dependency-free managed profile/config merge helper for published installs.

4 * P201.08: additive ownership, SHA-256 evidence, atomic apply and safe rollback.

5 */

7const crypto = require('node:crypto');

8const

packages/client/dist/commands/invoke.jsView file

Lines 1-21javascript

1import{createHash as Ne,randomUUID as qe}from"node:crypto";import{execFileSync as ke}from"node:child_process";import{existsSync as Ce,readFileSync as Ae,renameSync as Ln,unlinkSync as xn,writeFileSync as

packages/client/dist/config/secure-config.jsView file

Lines 1-13javascript

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 2077 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

packages/client/dist/runner/scheduler.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/client/dist/runner/scheduler.js#virtual:normalized:round1View on unpkg

packages/client/dist/runner/headless/continuous-story-workspace.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.45 matchedPath = [redacted]-story-workspace.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High