Loading npm security reports…

@ornexus/neocortex@4.60.45: AI-agent control-surface risk | LPM Firewall

registry / @ornexus/neocortex / 4.60.45

@ornexus/neocortex@4.60.45

Neocortex v4.60.45 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook automatically launches a quiet installer during global installation. The installer defaults to a Claude Code target and writes Neocortex agent files into the user's AI-agent configuration area.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm installation of the package.

Impact

The package changes a foreign AI-agent control surface without an interactive consent step, enabling the installed agent configuration to affect later agent sessions.

Mechanism

The lifecycle hook invokes install.sh with automatic flags; the script selects Claude Code by default and copies agent definitions into the home-directory Claude agents location.

Policy narrative

Installing this package globally triggers its postinstall hook. The hook silently starts the bundled installer with automatic flags. In the absence of a target selection, that installer chooses Claude Code, creates a destination under the user's home-directory Claude agent configuration, and copies Neocortex agent files there. The package also contains refresh targets for several other agent products. This is an unconsented lifecycle-time mutation of an external AI-agent control surface.

AI rationale

The lifecycle hook performs automatic, non-interactive modification of a foreign AI-agent configuration directory. This meets the install-control-surface blocking criterion even though no separate credential-exfiltration behavior was identified.

Evidence

postinstall.jsinstall.shpackages/client/dist/agent/refresh-stubs.js

Decision evidence

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

13L14: const { spawn } = require('child_process'); L15: const path = require('path');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = postinstall.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ornexus/neocortex@4.60.38 matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.38 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install.jsView on unpkg

144/** L145: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters. L146: * To add a new flag, just add an entry here. No switch/case to update.

High

Shell

Package source references shell execution.

install.jsView on unpkg · L144

475L476: const { execSync } = require('child_process'); L477: try { L478: // Run npm install -g silently, capture output L479: execSync('npm install -g @ornexus/neocortex@latest', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L475

targets-stubs/lib/managed-config-merge.jsView file

6L7: const crypto = require('node:crypto'); L8: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

targets-stubs/lib/managed-config-merge.jsView on unpkg · L6

packages/client/dist/commands/invoke.jsView file

1import{createHash as be,randomUUID as ze}from"node:crypto";import{execFileSync as Le}from"node:child_process";import{existsSync as ve,readFileSync as _e,renameSync as vn,unlinkSync... L2: `,{encoding:"utf8",mode:384,flag:"wx"}),vn(r,n)}function Or(e){return be("sha256").update(`nx-epic-logical-operation-v1\0${JSON.stringify({command:"create-epic",args:e})}`,"utf8").... ... L9: `),{}}}function Gi(e,t){return{kind:"full",trigger:e,targetEpicId:null,targetStoryId:null,includedStoryCount:Object.keys(t.stories).length,includedEpicCount:Object.keys(t.epics).le... L10: `),o=new Et;const i=Lt(n,o,"auth-cache"),s=Lt(n,o,"tier-cache"),c=new kn({serverUrl:e,licenseKey:t??"",cacheProvider:i,strictReadOnly:r});let l;if(r){const g=await c.inspectToken()... L11: `),t}function mn(e,t){process.stderr.w

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

packages/client/dist/commands/invoke.jsView on unpkg · L1

1import{createHash as be,randomUUID as ze}from"node:crypto";import{execFileSync as Le}from"node:child_process";import{existsSync as ve,readFileSync as _e,renameSync as vn,unlinkSync... L2: `,{encoding:"utf8",mode:384,flag:"wx"}),vn(r,n)}function Or(e){return be("sha256").update(`nx-epic-logical-operation-v1\0${JSON.stringify({command:"create-epic",args:e})}`,"utf8").... L3: `);process.stderr.write(`[Neocortex] state.json schema drift detected: ... L9: `),{}}}function Gi(e,t){return{kind:"full",trigger:e,targetEpicId:null,targetStoryId:null,includedStoryCount:Object.keys(t.stories).length,includedEpicCount:Object.keys(t.epics).le... L10: `),o=new Et;const i=Lt(n,o,"auth-cache"),s=Lt(n,o,"tier-cache"),c=new kn({serverUrl:e,licenseKey:t??"",cacheProvider:i,strictReadOnly:r});let l;if(r){co

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

packages/client/dist/config/secure-config.jsView file

1import{existsSync as u,readFileSync as R,writeFileSync as S,mkdirSync as L,chmodSync as y}from"node:fs";import{execSync as d}from"node:child_process";import{join as l}from"node:pat... L2: [!] Warning: connected to local server (`+t+`). L3: To use production, run: neocortex activate YOUR-LICENSE-KEY L4: Get yours at https://neocortex.sh/portal/login L5: `))}function w(r){const t=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!t)return null;const[,e,o,n=""]=t;return o.toLowerCase()!==C?null:`${e}api.neocortex.sh${n}`}function G(r={}){tr... L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${c.slice(0,12)}...).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

packages/client/dist/config/secure-config.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = [redacted]-config.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/config/secure-config.jsView on unpkg

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 2077 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

packages/client/dist/runner/scheduler.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/client/dist/runner/scheduler.js#virtual:normalized:round1View on unpkg

packages/client/dist/runner/headless/continuous-story-workspace.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = [redacted]-story-workspace.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/continuous-story-workspace.jsView on unpkg

packages/client/dist/runner/scheduler.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = [redacted].js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/scheduler.jsView on unpkg

packages/client/dist/runner/headless/epic-merge-candidate-qa.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = [redacted]-merge-candidate-qa.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/epic-merge-candidate-qa.jsView on unpkg

packages/client/dist/runner/headless/epic-terminal-git-cli-adapter.jsView file

•matchType = token_shingles matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = [redacted]-terminal-git-cli-adapter.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/epic-terminal-git-cli-adapter.jsView on unpkg

install.shView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = install.sh matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.shView on unpkg

packages/client/dist/runner/headless/types.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = [redacted].js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/runner/headless/types.jsView on unpkg

packages/client/dist/tier/tier-aware-client.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = packages/client/dist/tier/tier-aware-client.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/client/dist/tier/tier-aware-client.jsView on unpkg

packages/shared/dist/nx-invoke-signature.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = packages/shared/dist/nx-invoke-signature.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/shared/dist/nx-invoke-signature.jsView on unpkg

packages/shared/dist/strict-readonly.jsView file

•matchType = normalized_sha256 matchedPackage = @ornexus/neocortex@4.60.26 matchedPath = packages/shared/dist/strict-readonly.js matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.60.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/shared/dist/strict-readonly.jsView on unpkg