registry / AI-agent control-surface risk / @oxgeneral/orch

@oxgeneral/orch

AI agent runtime — orchestrate Claude, Cursor, Codex & OpenCode as one team. Multi-agent task automation with state machine, auto-retry, inter-agent messaging, goals and teams. Zero-config CLI + programmatic API.

This report shows the evidence for @oxgeneral/orch@1.0.27. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Static source inspection confirms lifecycle-triggered writes into ~/.claude/skills, a foreign/broad AI-agent control surface covered by the block policy. The absence of network exfiltration does not remove the unconsented install-time agent control mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of @oxgeneral/orch@1.0.27

Impact

Registers package-supplied /orch instructions in Claude Code outside the package namespace at install time, giving the package an agent control foothold without explicit user invocation.

Mechanism

unconsented lifecycle write to Claude Code skill directory

Policy narrative

On install, npm runs scripts/postinstall.cjs. The script reads skills/orch/SKILL.md from the package, creates ~/.claude/skills/orch, and writes SKILL.md there, registering a Claude Code skill from a lifecycle hook rather than an explicit user command. The same hook also rewrites Ink build files under node_modules.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsskills/orch/SKILL.md~/.claude/skills/orch/SKILL.mdnode_modules/ink/build/wrap-text.jsnode_modules/ink/build/measure-text.jsnode_modules/ink/build/output.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall: node scripts/postinstall.cjs || true
scripts/postinstall.cjs writes package skill to ~/.claude/skills/orch/SKILL.md during npm install
scripts/postinstall.cjs mutates dependency files under node_modules/ink/build at install time
skills/orch/SKILL.md is packaged agent-facing instruction content for Claude Code

Evidence against

No network calls or endpoint use in scripts/postinstall.cjs
Postinstall catches errors and only shows banner in interactive stderr
Main package purpose is AI-agent orchestration with Claude/Codex/Cursor/OpenCode bins
No credential harvesting or exfiltration found in inspected install script

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

6 flagged

package.jsonView file

Lines 16-56json

16 "scripts",

17 "skills"

18 ],

19 "main": "./dist/index.js",

20 "types": "./dist/index.d.ts",

21 "exports": {

22 ".": {

23 "import": "./dist/index.js",

24 "types": "./dist/index.d.ts"

25 }

26 },

27 "scripts": {

28 "dev": "tsx src/bin/cli.ts",

29 "build": "tsup",

30 "build:watch": "tsup --watch",

31 "test": "vitest run",

32 "test:watch": "vitest",

33 "coverage": "vitest run --coverage",

34 "typecheck": "tsc --noEmit",

35 "clean": "rm -rf dist",

36 "postinstall": "node scripts/postinstall.cjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "benchmark": "tsx scripts/benchmark.ts",

38 "load-test": "tsx scripts/load-test.ts",

39 "prepublishOnly": "npm run build"

40 },

41 "keywords": [

42 "ai-agent",

43 "ai-agent-runtime",

44 "agent-orchestrator",

45 "agent-orchestration",

46 "multi-agent",

47 "ai-agents",

48 "ai-team",

49 "llm-orchestration",

50 "task-automation",

51 "claude",

52 "claude-code",

53 "codex",

54 "cursor",

55 "opencode",

56 "grok",

dist/chunk-6DWHQPTE.jsView file

Lines 1-29javascript

1// src/infrastructure/adapters/registry.ts

2var AdapterRegistry = class {

3 adapters = /* @__PURE__ */ new Map();

4 register(adapter) {

scripts/postinstall.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Post-install: patch Ink caches, install Claude Code skill, show banner.

5 * Pure Node.js, no dependencies.

6 */

8const { readFileSync, writeFileSync, existsSync, mkdirSync } =

scripts/release.shView file

•path = scripts/release.sh kind = build_helper sizeBytes = 929 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-6DWHQPTE.jsView file

9} L10: require(kind) { L11: const adapter = this.adapters.get(kind);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-6DWHQPTE.jsView on unpkg · L9

Findings

1 Critical2 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/postinstall.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-6DWHQPTE.js

MediumEnvironment Vars

MediumShips Build Helperscripts/release.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @oxgeneral/orch@1.0.27.

The versions list below shows the verdict for each recorded version.

Avoid installing @oxgeneral/orch@1.0.27. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-04 13:11:47.870Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.27latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 4, 2026, 10:52 AM 1.0.26MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 4, 2026, 10:15 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code