@ornexus/neocortex@4.60.20: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@ornexus/neocortex@4.60.20: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

13L14: const { spawn } = require('child_process'); L15: const path = require('path');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L13

install.jsView file

101/** L102: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters. L103: * To add a new flag, just add an entry here. No switch/case to update.

High

Shell

Package source references shell execution.

install.jsView on unpkg · L101

414L415: const { execSync } = require('child_process'); L416: try { L417: // Run npm install -g silently, capture output L418: execSync('npm install -g @ornexus/neocortex@latest', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L414

targets-stubs/lib/managed-config-merge.jsView file

6L7: const crypto = require('node:crypto'); L8: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

targets-stubs/lib/managed-config-merge.jsView on unpkg · L6

packages/client/dist/config/secure-config.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ornexus/neocortex@4.59.14 matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.59.14 similarity = 0.671 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/client/dist/config/secure-config.jsView on unpkg

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from"node:pat... L2: [!] Warning: connected to local server (`+t+`). L3: To use production, run: neocortex activate YOUR-LICENSE-KEY L4: Get yours at https://neocortex.sh/portal/login L5: `))}function w(r){const t=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!t)return null;const[,e,o,n=""]=t;return o.toLowerCase()!==C?null:`${e}api.neocortex.sh${n}`}function G(r={}){tr... L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${c.slice(0,12)}...).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

packages/client/dist/config/secure-config.jsView on unpkg · L1

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 66-106json

66 "packages/shared/dist/invocation/",

67 "packages/shared/dist/generated/command-registry.generated.js",

68 "packages/shared/dist/generated/invocation-schema.generated.js",

69 "packages/shared/dist/yoloop/wave-decision-receipt.js",

70 "!packages/client/dist/**/*.js.map",

71 "!packages/client/dist/**/*.d.ts.map",

72 "targets-stubs/",

73 "dist/sbom.cdx.json"

74 ],

75 "scripts": {

76 "test": "node scripts/test-root.mjs",

77 "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs && node scripts/verify-compiled-invoke-signature.cjs",

78 "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",

79 "build:client": "npm run build -w packages/client",

80 "build:shared": "npm run build -w packages/shared",

81 "command-registry:generate": "npm run build:shared && node scripts/generate-command-registry.mjs",

82 "command-registry:check": "npm run build:shared && node scripts/generate-command-registry.mjs --check",

83 "command-registry:migrate-project": "node scripts/migrate-command-registry-project-id.mjs",

84 "command-registry:migrate-claim-scope": "node scripts/migrate-epic-claim-scope.mjs",

85 "test:p205-registry": "vitest run tests/p205-registry",

86 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L86

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L86

87 "sync": "node sync-version.js",

88 "validate": "node scripts/validate-pre-publish.js",

89 "validate:pre-publish": "node scripts/validate-pre-publish.js",

90 "validate:client-artifacts": "node scripts/validate-client-artifacts.mjs",

91 "validate:bash": "bash scripts/validate-pre-publish.sh",

92 "admin:dev": "cd admin && npm run dev",

93 "admin:build": "cd admin && npm run build",

94 "admin:test": "cd admin && npm run test",

95 "admin:lint": "cd admin && npm run lint",

96 "portal:dev": "cd portal && npm run dev",

97 "portal:build": "cd portal && npm run build",

98 "portal:test": "cd portal && npm run test",

99 "storybook": "storybook dev -p 6006",

100 "storybook:build": "storybook build --output-dir storybook-static",

101 "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",

102 "remotion:studio": "remotion studio remotion/index.ts --public-dir=landing/public",

103 "remotion:typecheck": "tsc --noEmit -p remotion/tsconfig.json",

104 "remotion:render:release": "node scripts/render-release-reel.mjs video",

105 "remotion:still:release": "node scripts/render-release-reel.mjs still",

106 "remotion:still:release:safe-zone": "node scripts/render-release-reel.mjs safe-zone",

postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3/**

4 * Neocortex - Postinstall Hook

5 *

6 * For global installs: auto-runs the installer in quiet/auto mode.

7 * For local installs: prints usage message.

8 *

9 * NEVER fails npm install -- always exits 0.

10 *

11 * Epic 62 - GAP 6

12 */

install.jsView file

Lines 81-121javascript

81 }

82 return null;

83}

84

85function isAutoYes() {

86 return args.includes('-y') || args.includes(

targets-stubs/lib/managed-config-merge.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/*

3 * Dependency-free managed profile/config merge helper for published installs.

4 * P201.08: additive ownership, SHA-256 evidence, atomic apply and safe rollback.

5 */

6

7const crypto = require('node:crypto');

8const

packages/client/dist/config/secure-config.jsView file

Lines 1-13javascript

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

Lines 394-434javascript

394 env: process.env,

395 });

396 child.on('error', (err) => {

397 console.error(`Failed to delegate to neocortex-client: ${err.message}`);

398 process.exit(1);

399 });

400 child.on('exit', (code) => process.exit(code ?? 1));

401 return; // Do not continue with install wizard

402 }

403

404 // ── Update command (Epic P86 - Story P86.07) ─────────────────────────

405 // Handled directly (not delegated to neocortex-client) because update

406 // needs npm which is in the installer's scope, not the client's.

407 if (firstArg === 'update') {

408 const currentVersion = VERSION;

409 console.log('');

410 console.log(color.cyan(' Neocortex Update'));

411 console.log(color.dim(` Current version: v${currentVersion}`));

412 console.log('');

413 console.log(color.dim(' Updating to latest version...'));

414

415 const { execSync } = require('child_process');

416 try {

417 // Run npm install -g silently, capture output

418 execSync('npm install -g @ornexus/neocortex@latest', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L414

419 stdio: ['pipe', 'pipe', 'pipe'],

420 timeout: 120000, // 2 min timeout

421 });

422

423 // Read new version

424 let newVersion = currentVersion;

425 try {

426 const newPkg = JSON.parse(fs.readFileSync(path.join(SCRIPT_DIR, 'package.json'), 'utf8'));

427 newVersion = newPkg.version;

428 } catch {

429 // Fallback: query npm for installed version

430 try {

431 const lsOutput = execSync('npm ls -g @ornexus/neocortex --depth=0 --json 2>/dev/null', {

432 encoding: 'utf-8', timeout: 10000,

433 });

434 const match = lsOutput.match(/"version":\s*"([^"]+)"/);