registry / AI-agent control-surface risk / @ornexus/neocortex / 4.60.38

@ornexus/neocortex@4.60.38

Neocortex v4.60.38 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package automatically changes AI-agent configuration during a global npm lifecycle hook and performs cleanup outside its own directory. The behavior is concerning but the inspected source does not prove a complete malicious payload or exfiltration chain.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g @ornexus/neocortex

Impact

It can add Neocortex agent files to the user's Claude configuration and delete matching legacy configuration files without an interactive confirmation.

Mechanism

Postinstall-driven AI-agent configuration mutation and cleanup

AI rationale

Evidence

package.jsonpostinstall.jsinstall.sh$HOME/.claude$HOME/.claude/agents$HOME/.claude/agents/neocortex$HOME/.cursor/neocortex$HOME/.cursorrules$HOME/.vscode/neocortex$HOME/.codex/neocortex

Network endpoints1

api.neocortex.sh/health

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 90.0% confidence with low false-positive risk.

Evidence for policy risk

The package declares an automatic postinstall lifecycle hook.
On global installation, postinstall silently launches install.sh with automatic, quiet, and project-skip flags.
The installer defaults to Claude Code and creates a Neocortex agent directory under the user's Claude configuration.
The automatic cleanup removes some unrelated-looking legacy configuration files when their contents match broad vendor terms.

Evidence against

The lifecycle launcher limits automatic installation to global npm installs; local installs only show usage.
No credential harvesting or secret exfiltration was confirmed in the inspected lifecycle files.
The only confirmed lifecycle network request is a version-health check to the vendor API.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

24 flagged

package.jsonView file

Lines 73-113json

73 "packages/shared/dist/yoloop/planning-graph.js",

74 "packages/shared/dist/yoloop/public-story-write-set.js",

75 "!packages/client/dist/**/*.js.map",

76 "!packages/client/dist/**/*.d.ts.map",

77 "targets-stubs/",

78 "dist/sbom.cdx.json"

79 ],

80 "scripts": {

81 "test": "node scripts/test-root.mjs",

82 "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs && node scripts/verify-compiled-invoke-signature.cjs",

83 "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",

84 "build:client": "npm run build -w packages/client",

85 "build:shared": "npm run build -w packages/shared",

86 "build:server": "npm run build -w packages/server",

87 "command-registry:generate": "npm run build:shared && node scripts/generate-command-registry.mjs",

88 "command-registry:check": "npm run build:shared && node scripts/generate-command-registry.mjs --check",

89 "command-registry:migrate-project": "node scripts/migrate-command-registry-project-id.mjs",

90 "command-registry:migrate-claim-scope": "node scripts/migrate-epic-claim-scope.mjs",

91 "test:p205-registry": "vitest run tests/p205-registry",

92 "test:installed-migration": "node scripts/test-installed-migration-smoke.mjs",

93 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "sync": "node sync-version.js",

95 "validate": "node scripts/validate-pre-publish.js",

96 "validate:pre-publish": "node scripts/validate-pre-publish.js",

97 "validate:client-artifacts": "node scripts/validate-client-artifacts.mjs",

98 "validate:bash": "bash scripts/validate-pre-publish.sh",

99 "admin:dev": "cd admin && npm run dev",

100 "admin:build": "cd admin && npm run build",

101 "admin:test": "cd admin && npm run test",

102 "admin:lint": "cd admin && npm run lint",

103 "portal:dev": "cd portal && npm run dev",

104 "portal:build": "cd portal && npm run build",

105 "portal:test": "cd portal && npm run test",

106 "storybook": "storybook dev -p 6006",

107 "storybook:build": "storybook build --output-dir storybook-static",

108 "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",

109 "remotion:studio": "remotion studio remotion/index.ts --public-dir=landing/public",

110 "remotion:typecheck": "tsc --noEmit -p remotion/tsconfig.json",

111 "remotion:render:release": "node scripts/render-release-reel.mjs video",

112 "remotion:still:release": "node scripts/render-release-reel.mjs still",

113 "remotion:still:release:safe-zone": "node scripts/render-release-reel.mjs safe-zone",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Neocortex - Postinstall Hook

5 *

6 * For global installs: auto-runs the installer in quiet/auto mode.

7 * For local installs: prints usage message.

8 *

9 * NEVER fails npm install -- always exits 0.

10 *

11 * Epic 62 - GAP 6

12 */

install.jsView file

Lines 111-151javascript

111 }

112 return filtered;

113}

114

115function isAutoYes() {

116 return args.includes('-y') || args.includes('--yes'

targets-stubs/lib/managed-config-merge.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/*

3 * Dependency-free managed profile/config merge helper for published installs.

4 * P201.08: additive ownership, SHA-256 evidence, atomic apply and safe rollback.

5 */

7const crypto = require('node:crypto');

8const

packages/client/dist/commands/invoke.jsView file

Lines 1-21javascript

1import{createHash as we,randomUUID as Fe}from"node:crypto";import{execFileSync as Oe}from"node:child_process";import{existsSync as Te,readFileSync as ye,renameSync as Rn,unlinkSync as wn,writeFileSync as

packages/client/dist/config/secure-config.jsView file

Lines 1-13javascript

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

packages/client/dist/runner/headless/continuous-story-workspace.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.35 matchedPath = [redacted]-story-workspace.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.35 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High