Loading npm security reports…

@ornexus/neocortex@4.60.28: AI-agent control-surface risk | LPM Firewall

registry / @ornexus/neocortex / 4.60.28

@ornexus/neocortex@4.60.28

Neocortex v4.60.28 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically changes the user's Claude Code control surface. It deletes selected files and registers MCP tools and a remote service configuration without an interactive consent step.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm global installation, which runs postinstall.

Impact

It can remove user configuration artifacts and give Claude Code new user-scope tools that execute downloaded third-party packages or contact remote services.

Mechanism

Automatic installer mutates AI-agent configuration and registers MCP commands.

Policy narrative

The postinstall hook detects global installation and launches install.sh with --yes, --quiet, and --skip-project. That path automatically cleans selected files beneath the user's Claude configuration, creates Neocortex agent configuration, and registers user-scope Claude MCP tools, including npx-fetched packages. It also configures the Neocortex remote endpoint. These are automatic mutations of a broad AI-agent control surface rather than an explicit user setup command.

Rationale

This is malicious install-hook abuse under the stated policy because an automatic npm lifecycle hook silently mutates a user's AI-agent configuration, deletes artifacts, and adds executable MCP integrations. The lack of a self-dependency does not mitigate that concrete behavior.

Evidence

package.jsonpostinstall.jsinstall.sh$HOME/.claude/agents/.git$HOME/.claude/.claude$HOME/.claude/agents/neocortex

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

13L14: const { spawn } = require('child_process'); L15: const path = require('path');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = postinstall.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ornexus/neocortex@4.60.20 matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.20 similarity = 0.675 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install.jsView on unpkg

131/** L132: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters. L133: * To add a new flag, just add an entry here. No switch/case to update.

High

Shell

Package source references shell execution.

install.jsView on unpkg · L131

462L463: const { execSync } = require('child_process'); L464: try { L465: // Run npm install -g silently, capture output L466: execSync('npm install -g @ornexus/neocortex@latest', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L462

targets-stubs/lib/managed-config-merge.jsView file

6L7: const crypto = require('node:crypto'); L8: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

targets-stubs/lib/managed-config-merge.jsView on unpkg · L6

packages/client/dist/commands/invoke.jsView file

1import{createHash as we,randomUUID as Fe}from"node:crypto";import{execFileSync as Oe}from"node:child_process";import{existsSync as Te,readFileSync as ye,renameSync as Rn,unlinkSync... L2: `,{encoding:"utf8",mode:384,flag:"wx"}),Rn(r,n)}function Tr(e){return we("sha256").update(`nx-epic-logical-operation-v1\0${JSON.stringify({command:"create-epic",args:e})}`,"utf8").... ... L8: `).filter(Boolean),g=new Map(h.map((b,y)=>[b,y])),f=t.match(/(?:^|\s)@?docs\/stories\/([A-Za-z][A-Za-z0-9._-]*)\.story\.md(?:\s|$)/)?.[1],u=new Set,I=Object.entries(s).flatMap(([b,... L9: `),r=new yt;const i=Nt(n,r,"auth-cache"),s=Nt(n,r,"tier-cache"),d=new bn({serverUrl:e,licenseKey:t??"",cacheProvider:i,strictReadOnly:o}),p=await d.getToken();if(!p)return null;con... L10: `),t}function pn(e,t){process.stderr.wr

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

packages/client/dist/commands/invoke.jsView on unpkg · L1

1import{createHash as we,randomUUID as Fe}from"node:crypto";import{execFileSync as Oe}from"node:child_process";import{existsSync as Te,readFileSync as ye,renameSync as Rn,unlinkSync... L2: `,{encoding:"utf8",mode:384,flag:"wx"}),Rn(r,n)}function Tr(e){return we("sha256").update(`nx-epic-logical-operation-v1\0${JSON.stringify({command:"create-epic",args:e})}`,"utf8").... L3: `);process.stderr.write(`[Neocortex] state.json schema drift detected: ... L8: `).filter(Boolean),g=new Map(h.map((b,y)=>[b,y])),f=t.match(/(?:^|\s)@?docs\/stories\/([A-Za-z][A-Za-z0-9._-]*)\.story\.md(?:\s|$)/)?.[1],u=new Set,I=Object.entries(s).flatMap(([b,... L9: `),r=new yt;const i=Nt(n,r,"auth-cache"),s=Nt(n,r,"tier-cache"),d=new bn({serverUrl:e,licenseKey:t??"",cacheProvider:i,strictReadOnly:o}),p=await d.getTo

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

packages/client/dist/config/secure-config.jsView file

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from"node:pat... L2: [!] Warning: connected to local server (`+t+`). L3: To use production, run: neocortex activate YOUR-LICENSE-KEY L4: Get yours at https://neocortex.sh/portal/login L5: `))}function w(r){const t=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!t)return null;const[,e,o,n=""]=t;return o.toLowerCase()!==C?null:`${e}api.neocortex.sh${n}`}function G(r={}){tr... L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${c.slice(0,12)}...).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

packages/client/dist/config/secure-config.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = [redacted]-config.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/config/secure-config.jsView on unpkg

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

packages/client/dist/runner/scheduler.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = [redacted].js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/scheduler.jsView on unpkg

packages/shared/dist/nx-invoke-signature.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = packages/shared/dist/nx-invoke-signature.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/shared/dist/nx-invoke-signature.jsView on unpkg

packages/shared/dist/strict-readonly.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = packages/shared/dist/strict-readonly.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/shared/dist/strict-readonly.jsView on unpkg

Source & flagged code

18 flagged

package.jsonView file

Lines 72-112json

72 "packages/shared/dist/yoloop/planning-graph.js",

73 "packages/shared/dist/yoloop/public-story-write-set.js",

74 "!packages/client/dist/**/*.js.map",

75 "!packages/client/dist/**/*.d.ts.map",

76 "targets-stubs/",

77 "dist/sbom.cdx.json"

78 ],

79 "scripts": {

80 "test": "node scripts/test-root.mjs",

81 "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs && node scripts/verify-compiled-invoke-signature.cjs",

82 "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",

83 "build:client": "npm run build -w packages/client",

84 "build:shared": "npm run build -w packages/shared",

85 "build:server": "npm run build -w packages/server",

86 "command-registry:generate": "npm run build:shared && node scripts/generate-command-registry.mjs",

87 "command-registry:check": "npm run build:shared && node scripts/generate-command-registry.mjs --check",

88 "command-registry:migrate-project": "node scripts/migrate-command-registry-project-id.mjs",

89 "command-registry:migrate-claim-scope": "node scripts/migrate-epic-claim-scope.mjs",

90 "test:p205-registry": "vitest run tests/p205-registry",

91 "test:installed-migration": "node scripts/test-installed-migration-smoke.mjs",

92 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 "sync": "node sync-version.js",

94 "validate": "node scripts/validate-pre-publish.js",

95 "validate:pre-publish": "node scripts/validate-pre-publish.js",

96 "validate:client-artifacts": "node scripts/validate-client-artifacts.mjs",

97 "validate:bash": "bash scripts/validate-pre-publish.sh",

98 "admin:dev": "cd admin && npm run dev",

99 "admin:build": "cd admin && npm run build",

100 "admin:test": "cd admin && npm run test",

101 "admin:lint": "cd admin && npm run lint",

102 "portal:dev": "cd portal && npm run dev",

103 "portal:build": "cd portal && npm run build",

104 "portal:test": "cd portal && npm run test",

105 "storybook": "storybook dev -p 6006",

106 "storybook:build": "storybook build --output-dir storybook-static",

107 "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",

108 "remotion:studio": "remotion studio remotion/index.ts --public-dir=landing/public",

109 "remotion:typecheck": "tsc --noEmit -p remotion/tsconfig.json",

110 "remotion:render:release": "node scripts/render-release-reel.mjs video",

111 "remotion:still:release": "node scripts/render-release-reel.mjs still",

112 "remotion:still:release:safe-zone": "node scripts/render-release-reel.mjs safe-zone",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3/**

4 * Neocortex - Postinstall Hook

5 *

6 * For global installs: auto-runs the installer in quiet/auto mode.

7 * For local installs: prints usage message.

8 *

9 * NEVER fails npm install -- always exits 0.

10 *

11 * Epic 62 - GAP 6

12 */

install.jsView file

Lines 111-151javascript

111 }

112 return filtered;

113}

114

115function isAutoYes() {

116 return args.includes('-y') || args.includes('--yes'

targets-stubs/lib/managed-config-merge.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/*

3 * Dependency-free managed profile/config merge helper for published installs.

4 * P201.08: additive ownership, SHA-256 evidence, atomic apply and safe rollback.

5 */

6

7const crypto = require('node:crypto');

8const

packages/client/dist/commands/invoke.jsView file

Lines 1-21javascript

1import{createHash as we,randomUUID as Fe}from"node:crypto";import{execFileSync as Oe}from"node:child_process";import{existsSync as Te,readFileSync as ye,renameSync as Rn,unlinkSync as wn,writeFileSync as

packages/client/dist/config/secure-config.jsView file

Lines 1-13javascript

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

packages/client/dist/runner/scheduler.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = [redacted].js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/scheduler.jsView on unpkg

packages/shared/dist/nx-invoke-signature.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = packages/shared/dist/nx-invoke-signature.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/shared/dist/nx-invoke-signature.jsView on unpkg

packages/shared/dist/strict-readonly.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.23 matchedPath = packages/shared/dist/strict-readonly.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/shared/dist/strict-readonly.jsView on unpkg