registry / @ornexus/neocortex / 4.63.5

@ornexus/neocortex@4.63.5

⚠ Under review

Neocortex v4.63.5 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 106 file(s), 892 KB of source, external domains: aka.ms, api.neocortex.sh, neocortex.sh, schemas.microsoft.com, www.apple.com

Source & flagged code

11 flagged

package.jsonView file

Lines 57-97json

57 "install.ps1",

58 "docs/install/linux-global-install.md",

59 "docs/install/coderabbit-manual-setup.md",

60 "docs/install/installer-diagnostics.md",

61 "postinstall.js",

62 "packages/client/dist/",

63 "!packages/client/dist/**/*.js.map",

64 "!packages/client/dist/**/*.d.ts.map",

65 "targets-stubs/",

66 "dist/sbom.cdx.json"

67 ],

68 "scripts": {

69 "test": "node scripts/test-root.mjs",

70 "test:fast": "npm --prefix packages/server test -- public-output-ip-dlp protected-execution-worker invoke-e2e arch-plan-brownfield-ux arch-plan-product-experience p201-zero-pi-arch-plan-e2e && npm --prefix packages/client test -- platform-detector invoke project-evidence-collector public-execution/dispatch && npm --prefix packages/shared test -- public-execution-contract project-evidence-contract",

71 "test:pr": "npm run test:fast && npm --prefix packages/shared run build && npm --prefix packages/client run build && npm --prefix packages/client test -- tarball-validation stubs-integrity p155-install-regression-suite && npm --prefix packages/server run build -- --noEmit",

72 "test:release": "npx vitest run --config vitest.config.ts packages/shared/src packages/core/src && npm run build && npm --prefix packages/client test && npm test -- --runInBand && npm run test:fast && npm --prefix packages/server test -- p201-zero-pi-public-safety p201-downstream-ux-propagation p201-encrypted-asset-bundle p201-encrypted-production-deploy shared-types-sync quota-v2-flags && npm --prefix packages/server run build -- --noEmit && npm --prefix packages/server run bundle && npm run storybook:build && npm run storybook:smoke && npm run sbom && npm run validate && bash scripts/ip- ...

73 "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs",

74 "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",

75 "build:client": "npm run build -w packages/client",

76 "build:shared": "npm run build -w packages/shared",

77 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "sync": "node sync-version.js",

79 "validate": "node scripts/validate-pre-publish.js",

80 "validate:bash": "bash scripts/validate-pre-publish.sh",

81 "admin:dev": "cd admin && npm run dev",

82 "admin:build": "cd admin && npm run build",

83 "admin:test": "cd admin && npm run test",

84 "admin:lint": "cd admin && npm run lint",

85 "portal:dev": "cd portal && npm run dev",

86 "portal:build": "cd portal && npm run build",

87 "portal:test": "cd portal && npm run test",

88 "storybook": "storybook dev -p 6006",

89 "storybook:build": "storybook build --output-dir storybook-static",

90 "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",

91 "test:e2e": "bash scripts/e2e-smoke-test.sh",

92 "sbom": "bash scripts/generate-sbom.sh",

93 "prepublishOnly": "npm run build && npm --prefix packages/server run build -- --noEmit && node scripts/validate-pre-publish.js && node sync-version.js && npm run sbom

94 "version": "npm run sync && echo 'Nova versao:' && cat package.json | grep version"

95 },

96 "engines": {

97 "node": ">=18.0.0"

Long lines were clipped for display.

postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Neocortex - Postinstall Hook

5 *

6 * For global installs: auto-runs the installer in quiet/auto mode.

7 * For local installs: prints usage message.

8 *

9 * NEVER fails npm install -- always exits 0.

10 *

11 * Epic 62 - GAP 6

12 */

install.jsView file

Lines 81-121javascript

81 }

82 return null;

83}

85function isAutoYes() {

86 return args.includes('-y') || args.includes('--yes') || args.includes('-Yes');

packages/client/dist/continuity/sqlite-store.jsView file

Lines 1-21javascript

1import{Buffer as z}from"node:buffer";import{createHash as M}from"node:crypto";import{chmodSync as X,existsSync as ye,mkdirSync as Ie}from"node:fs";import{join as Z}from"node:path";import{INITIAL_CONTINUITY_SQLITE_MIGRATION as Ee}from"./migrations/001-initial-schema.js"

targets-stubs/lib/mcp-merge.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/*

3 * Preserving user-scope MCP merge helper for published target stubs.

4 * It is intentionally dependency-free so npm tarball installs can use it.

5 */

7const fs = require('fs');

8const path = require('path'

packages/client/dist/runner/scheduler.jsView file

Lines 1-8javascript

packages/client/dist/config/secure-config.jsView file

Lines 1-13javascript

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1831 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

13L14: const { spawn } = require('child_process'); L15: const path = require('path');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L13

install.jsView file

101/** L102: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters. L103: * To add a new flag, just add an entry here. No switch/case to update.

High

Shell

Package source references shell execution.

install.jsView on unpkg · L101

414L415: const { execSync } = require('child_process'); L416: try { L417: // Run npm install -g silently, capture output L418: execSync('npm install -g @ornexus/neocortex@latest', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L414

packages/client/dist/continuity/sqlite-store.jsView file

1import{Buffer as z}from"node:buffer";import{createHash as M}from"node:crypto";import{chmodSync as X,existsSync as ye,mkdirSync as Ie}from"node:fs";import{join as Z}from"node:path";... L2: `)).digest("hex")}`,s=r(e),d=r(a);return{receipts:s,outputs:d,aggregate:`sha256:${M("sha256").update(`${t}:${s}:${d}`).digest("hex")}`}}function Xe(t){if(!t)return{};try{const e=JS...

Low

Eval

Package source references a known benign dynamic code generation pattern.

packages/client/dist/continuity/sqlite-store.jsView on unpkg · L1

targets-stubs/lib/mcp-merge.jsView file

6L7: const fs = require('fs'); L8: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

targets-stubs/lib/mcp-merge.jsView on unpkg · L6

packages/client/dist/runner/scheduler.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ornexus/neocortex@4.59.14 matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.59.14 similarity = 0.645 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/client/dist/runner/scheduler.jsView on unpkg

1import{Buffer as le}from"node:buffer";import{spawnSync as ie}from"node:child_process";import{existsSync as j,mkdirSync as de,readFileSync as me,writeFileSync as pe}from"node:fs";im... L2: `)}function je(e){const r=y(process.execPath);return!r||e.command===r?[e.command,...e.args]:[r,e.command,...e.args]}function Fe(e,r){return["[Unit]",`Description=Run Neocortex Ente... L3: `)}function $e(e,r,t,n){const s=[e.command,...e.args,"tick","--project-root",r,"--scheduled"];return['<?xml version="1.0" encoding="UTF-8"?>','<!DOCTYPE plist PUBLIC "-//Apple//DTD... L4: `)}function Be(e,r,t,n){const s=[...e.args,"tick","--project-root",r,"--scheduled"].map(ce).join(" ");return['<?xml version="1.0" encoding="UTF-16"?>','<Task version="1.4" xmlns="h... L5: `)}function Me(e,r,t){const n=[e.command,...e.args,"tick","--project-root",r,"--scheduled"].map(K).join(" ");return[t.cronMarkerStart,`# neocortex-runner user-scope cron fallback f...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/client/dist/runner/scheduler.jsView on unpkg · L1

packages/client/dist/config/secure-config.jsView file

1import{existsSync as p,readFileSync as U,writeFileSync as R,mkdirSync as S,chmodSync as u}from"node:fs";import{execSync as y}from"node:child_process";import{join as a}from"node:pat... L2: [!] Warning: connected to local server (`+e+`). L3: To use production, run: neocortex activate YOUR-LICENSE-KEY L4: Get yours at https://neocortex.sh/portal/login L5: `))}function F(r){const e=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!e)return null;const[,c,t,n=""]=e;return t.toLowerCase()!==K?null:`${c}api.neocortex.sh${n}`}function Y(){try{if... L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${n.slice(0,12)}...).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

packages/client/dist/config/secure-config.jsView on unpkg · L1

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1831 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

Findings

1 Critical5 High7 Medium6 Low

CriticalPrevious Version Dangerous Deltapackages/client/dist/runner/scheduler.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpostinstall.js

HighShellinstall.js

HighSandbox Evasion Gated Capabilitypackages/client/dist/config/secure-config.js

HighRuntime Package Installinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiretargets-stubs/lib/mcp-merge.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepackages/client/dist/runner/scheduler.js

MediumShips Build Helpertargets-stubs/cursor/install-cursor.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalpackages/client/dist/continuity/sqlite-store.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

package.jsonView file

Lines 57-97json

57 "install.ps1",

58 "docs/install/linux-global-install.md",

59 "docs/install/coderabbit-manual-setup.md",

60 "docs/install/installer-diagnostics.md",

61 "postinstall.js",

62 "packages/client/dist/",

63 "!packages/client/dist/**/*.js.map",

64 "!packages/client/dist/**/*.d.ts.map",

65 "targets-stubs/",

66 "dist/sbom.cdx.json"

67 ],

68 "scripts": {

69 "test": "node scripts/test-root.mjs",

73 "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs",

74 "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",

75 "build:client": "npm run build -w packages/client",

76 "build:shared": "npm run build -w packages/shared",

77 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "sync": "node sync-version.js",

79 "validate": "node scripts/validate-pre-publish.js",

80 "validate:bash": "bash scripts/validate-pre-publish.sh",

81 "admin:dev": "cd admin && npm run dev",

82 "admin:build": "cd admin && npm run build",

83 "admin:test": "cd admin && npm run test",

84 "admin:lint": "cd admin && npm run lint",

85 "portal:dev": "cd portal && npm run dev",

86 "portal:build": "cd portal && npm run build",

87 "portal:test": "cd portal && npm run test",

88 "storybook": "storybook dev -p 6006",

89 "storybook:build": "storybook build --output-dir storybook-static",

90 "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",

91 "test:e2e": "bash scripts/e2e-smoke-test.sh",

92 "sbom": "bash scripts/generate-sbom.sh",

93 "prepublishOnly": "npm run build && npm --prefix packages/server run build -- --noEmit && node scripts/validate-pre-publish.js && node sync-version.js && npm run sbom

94 "version": "npm run sync && echo 'Nova versao:' && cat package.json | grep version"

95 },

96 "engines": {

97 "node": ">=18.0.0"

Long lines were clipped for display.

postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Neocortex - Postinstall Hook

5 *

6 * For global installs: auto-runs the installer in quiet/auto mode.

7 * For local installs: prints usage message.

8 *

9 * NEVER fails npm install -- always exits 0.

10 *

11 * Epic 62 - GAP 6

12 */

install.jsView file

Lines 81-121javascript

81 }

82 return null;

83}

85function isAutoYes() {

86 return args.includes('-y') || args.includes('--yes') || args.includes('-Yes');

packages/client/dist/continuity/sqlite-store.jsView file

Lines 1-21javascript

targets-stubs/lib/mcp-merge.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/*

3 * Preserving user-scope MCP merge helper for published target stubs.

4 * It is intentionally dependency-free so npm tarball installs can use it.

5 */

7const fs = require('fs');

8const path = require('path'

packages/client/dist/runner/scheduler.jsView file

Lines 1-8javascript

packages/client/dist/config/secure-config.jsView file

Lines 1-13javascript

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1831 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg