registry / @ornexus/neocortex / 4.60.32

@ornexus/neocortex@4.60.32

Neocortex v4.60.32 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code

AI Security Review

scanned 1h ago · by lpm-firewall-ai

A global npm installation automatically runs a noninteractive installer. It deletes files in AI-tool directories and registers user-scope MCP servers, including external command-based servers.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package globally through npm.

Impact

It can alter the user's Claude and related AI-tool environment and introduce externally sourced MCP processes without interactive consent.

Mechanism

Postinstall launches an automatic shell installer that mutates AI-agent configuration and runs external MCP setup commands.

Attack narrative

npm executes postinstall during a global installation. The hook passes noninteractive flags to install.sh, which automatically removes legacy AI-tool files, installs package content, and configures user-scope Claude MCP servers. Some MCP entries execute packages through npx and one forwards available OpenAI or Anthropic API keys to browser-use. The package also makes an automatic health request to its service.

Rationale

This is an unconsented postinstall mutation of a broad AI-agent control surface, with deletion and external MCP registration. The automatic global-install path is concrete in the published source.

Evidence

package.jsonpostinstall.jsinstall.sh~/.claude~/.cursor~/.gemini~/.codex

Network endpoints3

api.neocortex.shmcp.context7.commcp.figma.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs postinstall automatically.
For global installs, postinstall launches the installer with automatic, quiet, and skip-project flags.
The installer automatically deletes legacy files and directories in several AI-tool home locations.
The automatic installer adds user-scope Claude MCP servers and invokes external package runners.
Postinstall contacts the package service without user action.

Evidence against

The lifecycle installer is limited to detected global installs; local installs only show usage.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 142 file(s), 1.38 MB of source, external domains: aka.ms, api.neocortex.sh, github.com, neocortex.sh, schemas.microsoft.com, www.apple.com

Source & flagged code

24 flagged

package.jsonView file

Lines 73-113json

73 "packages/shared/dist/yoloop/planning-graph.js",

74 "packages/shared/dist/yoloop/public-story-write-set.js",

75 "!packages/client/dist/**/*.js.map",

76 "!packages/client/dist/**/*.d.ts.map",

77 "targets-stubs/",

78 "dist/sbom.cdx.json"

79 ],

80 "scripts": {

81 "test": "node scripts/test-root.mjs",

82 "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs && node scripts/verify-compiled-invoke-signature.cjs",

83 "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",

84 "build:client": "npm run build -w packages/client",

85 "build:shared": "npm run build -w packages/shared",

86 "build:server": "npm run build -w packages/server",

87 "command-registry:generate": "npm run build:shared && node scripts/generate-command-registry.mjs",

88 "command-registry:check": "npm run build:shared && node scripts/generate-command-registry.mjs --check",

89 "command-registry:migrate-project": "node scripts/migrate-command-registry-project-id.mjs",

90 "command-registry:migrate-claim-scope": "node scripts/migrate-epic-claim-scope.mjs",

91 "test:p205-registry": "vitest run tests/p205-registry",

92 "test:installed-migration": "node scripts/test-installed-migration-smoke.mjs",

93 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "sync": "node sync-version.js",

95 "validate": "node scripts/validate-pre-publish.js",

96 "validate:pre-publish": "node scripts/validate-pre-publish.js",

97 "validate:client-artifacts": "node scripts/validate-client-artifacts.mjs",

98 "validate:bash": "bash scripts/validate-pre-publish.sh",

99 "admin:dev": "cd admin && npm run dev",

100 "admin:build": "cd admin && npm run build",

101 "admin:test": "cd admin && npm run test",

102 "admin:lint": "cd admin && npm run lint",

103 "portal:dev": "cd portal && npm run dev",

104 "portal:build": "cd portal && npm run build",

105 "portal:test": "cd portal && npm run test",

106 "storybook": "storybook dev -p 6006",

107 "storybook:build": "storybook build --output-dir storybook-static",

108 "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",

109 "remotion:studio": "remotion studio remotion/index.ts --public-dir=landing/public",

110 "remotion:typecheck": "tsc --noEmit -p remotion/tsconfig.json",

111 "remotion:render:release": "node scripts/render-release-reel.mjs video",

112 "remotion:still:release": "node scripts/render-release-reel.mjs still",

113 "remotion:still:release:safe-zone": "node scripts/render-release-reel.mjs safe-zone",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Neocortex - Postinstall Hook

5 *

6 * For global installs: auto-runs the installer in quiet/auto mode.

7 * For local installs: prints usage message.

8 *

9 * NEVER fails npm install -- always exits 0.

10 *

11 * Epic 62 - GAP 6

12 */

install.jsView file

Lines 111-151javascript

111 }

112 return filtered;

113}

114

115function isAutoYes() {

116 return args.includes('-y') || args.includes('--yes'

targets-stubs/lib/managed-config-merge.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/*

3 * Dependency-free managed profile/config merge helper for published installs.

4 * P201.08: additive ownership, SHA-256 evidence, atomic apply and safe rollback.

5 */

7const crypto = require('node:crypto');

8const

packages/client/dist/commands/invoke.jsView file

Lines 1-21javascript

packages/client/dist/config/secure-config.jsView file

Lines 1-13javascript

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

packages/client/dist/runner/headless/continuous-story-workspace.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = [redacted]-story-workspace.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/continuous-story-workspace.jsView on unpkg

packages/client/dist/runner/headless/run-yoloop.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = [redacted]-yoloop.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/run-yoloop.jsView on unpkg

packages/client/dist/runner/scheduler.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = [redacted].js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/scheduler.jsView on unpkg

packages/client/dist/runner/headless/epic-merge-candidate-qa.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = [redacted]-merge-candidate-qa.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/epic-merge-candidate-qa.jsView on unpkg

packages/client/dist/runner/headless/epic-terminal-git-cli-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = [redacted]-terminal-git-cli-adapter.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/epic-terminal-git-cli-adapter.jsView on unpkg

install.shView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = install.sh matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.shView on unpkg

packages/client/dist/runner/headless/types.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/types.jsView on unpkg

packages/client/dist/tier/tier-aware-client.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = packages/client/dist/tier/tier-aware-client.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/tier/tier-aware-client.jsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

13L14: const { spawn } = require('child_process'); L15: const path = require('path');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = postinstall.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

install.jsView file

131/** L132: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters. L133: * To add a new flag, just add an entry here. No switch/case to update.

High

Shell

Package source references shell execution.

install.jsView on unpkg · L131

462L463: const { execSync } = require('child_process'); L464: try { L465: // Run npm install -g silently, capture output L466: execSync('npm install -g @ornexus/neocortex@latest', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L462

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = install.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

targets-stubs/lib/managed-config-merge.jsView file

6L7: const crypto = require('node:crypto'); L8: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

targets-stubs/lib/managed-config-merge.jsView on unpkg · L6

packages/client/dist/commands/invoke.jsView file

1import{createHash as we,randomUUID as Fe}from"node:crypto";import{execFileSync as Oe}from"node:child_process";import{existsSync as Te,readFileSync as ye,renameSync as Rn,unlinkSync... L2: `,{encoding:"utf8",mode:384,flag:"wx"}),Rn(r,n)}function Tr(e){return we("sha256").update(`nx-epic-logical-operation-v1\0${JSON.stringify({command:"create-epic",args:e})}`,"utf8").... ... L8: `).filter(Boolean),g=new Map(h.map((b,y)=>[b,y])),f=t.match(/(?:^|\s)@?docs\/stories\/([A-Za-z][A-Za-z0-9._-]*)\.story\.md(?:\s|$)/)?.[1],u=new Set,I=Object.entries(s).flatMap(([b,... L9: `),r=new yt;const i=Nt(n,r,"auth-cache"),s=Nt(n,r,"tier-cache"),d=new bn({serverUrl:e,licenseKey:t??"",cacheProvider:i,strictReadOnly:o}),p=await d.getToken();if(!p)return null;con... L10: `),t}function pn(e,t){process.stderr.wr

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

packages/client/dist/commands/invoke.jsView on unpkg · L1

1import{createHash as we,randomUUID as Fe}from"node:crypto";import{execFileSync as Oe}from"node:child_process";import{existsSync as Te,readFileSync as ye,renameSync as Rn,unlinkSync... L2: `,{encoding:"utf8",mode:384,flag:"wx"}),Rn(r,n)}function Tr(e){return we("sha256").update(`nx-epic-logical-operation-v1\0${JSON.stringify({command:"create-epic",args:e})}`,"utf8").... L3: `);process.stderr.write(`[Neocortex] state.json schema drift detected: ... L8: `).filter(Boolean),g=new Map(h.map((b,y)=>[b,y])),f=t.match(/(?:^|\s)@?docs\/stories\/([A-Za-z][A-Za-z0-9._-]*)\.story\.md(?:\s|$)/)?.[1],u=new Set,I=Object.entries(s).flatMap(([b,... L9: `),r=new yt;const i=Nt(n,r,"auth-cache"),s=Nt(n,r,"tier-cache"),d=new bn({serverUrl:e,licenseKey:t??"",cacheProvider:i,strictReadOnly:o}),p=await d.getTo

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

packages/client/dist/commands/invoke.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> packages/client/dist/cli.js -> [redacted].js L1: import{createHash as we,randomUUID as Fe}from"node:crypto";import{execFileSync as Oe}from"node:child_process";import{existsSync as Te,readFileSync as ye,renameSync as Rn,unlinkSync... L2: `,{encoding:"utf8",mode:384,flag:"wx"}),Rn(r,n)}function Tr(e){return we("sha256").update(`nx-epic-logical-operation-v1\0${JSON.stringify({command:"create-epic",args:e})}`,"utf8").... L3: `);process.stderr.write(`[Neocortex] state.json schema drift detected: ... L8: `).filter(Boolean),g=new Map(h.map((b,y)=>[b,y])),f=t.match(/(?:^|\s)@?docs\/stories\/([A-Za-z][A-Za-z0-9._-]*)\.story\.md(?:\s|$)/)?.[1],u=new Set,I=Object.entries(s).flatMap(([b,... L9: `),r=new yt;const i=Nt(n,r,"auth-cache"

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

packages/client/dist/commands/invoke.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/commands/invoke.jsView on unpkg

packages/client/dist/config/secure-config.jsView file

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from"node:pat... L2: [!] Warning: connected to local server (`+t+`). L3: To use production, run: neocortex activate YOUR-LICENSE-KEY L4: Get yours at https://neocortex.sh/portal/login L5: `))}function w(r){const t=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!t)return null;const[,e,o,n=""]=t;return o.toLowerCase()!==C?null:`${e}api.neocortex.sh${n}`}function G(r={}){tr... L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${c.slice(0,12)}...).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

packages/client/dist/config/secure-config.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.31 matchedPath = [redacted]-config.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/config/secure-config.jsView on unpkg

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

packages/client/dist/runner/headless/continuous-story-workspace.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/continuous-story-workspace.jsView on unpkg

packages/client/dist/runner/headless/run-yoloop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/run-yoloop.jsView on unpkg

packages/client/dist/runner/scheduler.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/scheduler.jsView on unpkg

packages/client/dist/runner/headless/epic-merge-candidate-qa.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/epic-merge-candidate-qa.jsView on unpkg

packages/client/dist/runner/headless/epic-terminal-git-cli-adapter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/epic-terminal-git-cli-adapter.jsView on unpkg

install.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.shView on unpkg

packages/client/dist/runner/headless/types.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/types.jsView on unpkg

packages/client/dist/tier/tier-aware-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/tier/tier-aware-client.jsView on unpkg

Findings

21 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpostinstall.js

HighShellinstall.js

HighSame File Env Network Executionpackages/client/dist/commands/invoke.js

HighCommand Output Exfiltrationpackages/client/dist/commands/invoke.js

HighSandbox Evasion Gated Capabilitypackages/client/dist/config/secure-config.js

HighTrigger Reachable Command Output Exfiltrationpackages/client/dist/commands/invoke.js

HighRuntime Package Installinstall.js

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similarityinstall.js

HighKnown Malware Source Similaritypackages/client/dist/config/secure-config.js

HighKnown Malware Source Similaritypackages/client/dist/runner/headless/continuous-story-workspace.js

HighKnown Malware Source Similaritypostinstall.js

HighKnown Malware Source Similaritypackages/client/dist/runner/headless/run-yoloop.js

HighKnown Malware Source Similaritypackages/client/dist/runner/scheduler.js

HighKnown Malware Source Similaritypackages/client/dist/runner/headless/epic-merge-candidate-qa.js

HighKnown Malware Source Similaritypackages/client/dist/runner/headless/epic-terminal-git-cli-adapter.js

HighKnown Malware Source Similarityinstall.sh

HighKnown Malware Source Similaritypackages/client/dist/commands/invoke.js

HighKnown Malware Source Similaritypackages/client/dist/runner/headless/types.js

HighKnown Malware Source Similaritypackages/client/dist/tier/tier-aware-client.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiretargets-stubs/lib/managed-config-merge.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertargets-stubs/cursor/install-cursor.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings