Loading npm security reports…

@pmcai/codex-chat-widget@0.3.5: Malicious npm security report | LPM Firewall

registry / @pmcai/codex-chat-widget / 0.3.5

@pmcai/codex-chat-widget@0.3.5

Embeddable React chat widget for a Codex harness — plus a zero-dependency standalone server and CLI.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The running harness exposes an unauthenticated Gemini proxy that injects a phrase-triggered full-execution policy. It launches Codex with unrestricted sandbox access in the configured workspace.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Start the harness and send a request that reaches its proxy or chat service; the first-message role phrase activates the elevated policy.

Impact

An attacker able to reach the service can induce filesystem and command actions in the configured workspace.

Mechanism

Unauthenticated AI-agent policy bypass followed by unrestricted Codex execution.

Attack narrative

The package starts a Codex harness that forwards requests through an unauthenticated Gemini-compatible endpoint. Its injected policy promotes a first message containing a special phrase to full execution. The resulting Codex invocation disables approval and uses a danger-full-access sandbox, so a reachable attacker can cause commands and file changes in the configured workspace.

AI rationale

The hidden phrase-based privilege elevation, unauthenticated proxy route, and unrestricted command runner form a concrete remote agent-control chain. The lack of an install hook does not mitigate this runtime backdoor.

Evidence

server/index.jsserver/lib/gemini-responses.jsserver/lib/runner.js~/.pmai/workspace~/.pmai/.codex-runs/<run>

Network endpoints1

generativelanguage.googleapis.com/v1beta

Source & flagged code

5 flagged · loading source

server/bin.jsView file

16Manifest entrypoint (scripts.start) carries capability families absent from dist/build output: environment+network, execution+network L16: const { startDaemon, stopDaemon, readState, readLog, probeHealth, runPaths } = await import('./lib/daemon.js') L17: const { spawn } = await import('node:child_process') L18: const { existsSync, readFileSync } = await import('node:fs') ... L55: Examples: L56: pmcai start --port 4231 --allowed-origin https://my-site.example L57: pmcai status ... L97: if (opts.version) { L98: console.log(JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8')).version) L99: process.exit(0) ... L104: L105: const pmaiHome = opts.flags.pmaiHome || process.env.PMAI_HOME || join(process.env.HOME || '.', '.pmai') L106: const port = Number(opts.flags.port || process.en

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/bin.jsView on unpkg · L16

server/lib/gemini-models.jsView file

6} L7: const baseUrl = (process.env.GOOGLE_AI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta').replace(/\/$/, '') L8: const upstream = await fetch(`${baseUrl}/models?key=${encodeURIComponent(apiKey)}`, { cache: 'no-store' }) L9: const body = await upstream.json().catch(() => ({})) L10: if (!upstream.ok) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/lib/gemini-models.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> server/index.js -> server/lib/gemini-models.js L6: } L7: const baseUrl = (process.env.GOOGLE_AI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta').replace(/\/$/, '') L8: const upstream = await fetch(`${baseUrl}/models?key=${encodeURIComponent(apiKey)}`, { cache: 'no-store' }) L9: const body = await upstream.json().catch(() => ({})) L10: if (!upstream.ok) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server/lib/gemini-models.jsView on unpkg · L6

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

server/lib/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pmcai/codex-chat-widget@0.3.3 matchedIdentity = npm:[redacted]:0.3.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/lib/runner.jsView on unpkg

Source & flagged code

5 flagged

server/bin.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// Silence the node:sqlite ExperimentalWarning without a re-exec: patch process.emitWarning before

3// any dependency loads. (A child-process re-exec would need correct cross-platform path handling

4// and was the source of a Windows path bug — filtering the warning in-process is simpler and safe,

5// because a real sqlite failure still throws.)

6const originalEmitWarning = process.emitWarning

7process.emitWarning = (warning, ...rest) => {

8 const type = typeof rest[0] === 'string' ? rest[0] : (rest[0]?.type || '')

9 const text = typeof warning === 'string' ? warning : (warning?.message || '')

10 if (type === 'ExperimentalWarning' && /SQLite/i.test(text)) return

11 return originalEmitWarning.call(process, warning, ...rest)

12}

13

14const { createHarnessServer } = await import('./index.js')

15const { ensureCodex, CODEX_VERSION } = await import('./codex.js')

16const { startDaemon, stopDaemon, readState, readLog, probeHealth, runPaths } = await import('./lib/daemon.js')

17const { spawn } = await import('node:child_process')

18const { existsSync, readFileSync } = await import('node:fs')

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/bin.jsView on unpkg · L16

19const { join, dirname } = await import('node:path')

20const { fileURLToPath } = await import('node:url')

21

22const here = dirname(fileURLToPath(import.meta.url))

23

24const HELP = `

25pmcai — Codex Harness (standalone server + widget)

26

27Usage:

28 pmcai <command> [options]

29

30Commands:

31 start Start the harness in the background

32 stop Stop the background harness (--force for SIGKILL)

33 restart Stop then start

34 status Show whether the harness is running

35 logs Print the daemon log (-f to follow, -n <lines>)

36 run Run in the foreground (Ctrl-C to stop)

server/lib/gemini-models.jsView file

Lines 1-21javascript

1export async function geminiModels(apiKey) {

2 if (!apiKey) {

3 const error = new Error(

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

server/lib/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pmcai/codex-chat-widget@0.3.3 matchedIdentity = npm:[redacted]:0.3.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/lib/runner.jsView on unpkg