registry / Destructive action / @rowansenne/docnexus

@rowansenne/docnexus

[English README](./README.md)

This report shows the evidence for @rowansenne/docnexus@0.25.0. 2 of 18 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The manifest activates a postinstall hook that automatically deletes qualifying older DocNexus workspace data without migration or an affirmative user action. This is concrete install-time destructive behavior, so the package should be blocked.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A local npm installation where the postinstall hook resolves a consuming project containing a qualifying legacy workspace.

Impact

Existing project memory and other contents in the legacy workspace can be lost during installation.

Mechanism

The hook calls cleanupLegacyProject, which identifies older marked DocNexus directories and removes the workspace recursively.

Attack narrative

During local installation, the postinstall hook resolves the consuming project and runs legacy cleanup. When it finds an older marked DocNexus workspace, cleanup recursively removes that directory without migrating its contents. This can destroy project data as a side effect of installing the package.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/src/legacy-cleanup.jsdist/src/layout.jsdocnexus/

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs scripts/postinstall.mjs on install.
The hook invokes legacy cleanup for local installations and resolves the consuming project root.
Cleanup selects older DocNexus workspaces using their format marker, then recursively deletes selected directories.
The workspace directory is named docnexus; cleanup does not migrate its contents before removal.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 376 KB of source, external domains: 127.0.0.1

Source & flagged code

8 flagged

package.jsonView file

Lines 23-63json

23 "viewer",

24 "skills",

25 "scripts/postinstall.mjs",

26 "README.md",

27 "README.zh-CN.md",

28 "CHANGELOG.md",

29 "LICENSE",

30 "SECURITY.md",

31 "docs",

32 "!docs/operations/baselines"

33 ],

34 "publishConfig": {

35 "access": "public"

36 },

37 "bin": {

38 "docnexus": "dist/src/cli.js"

39 },

40 "scripts": {

41 "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json && node -e \"require('node:fs').chmodSync('dist/src/cli.js', 0o755)\"",

42 "prepack": "npm run build",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "vitest run",

45 "typecheck": "tsc -p tsconfig.json --noEmit",

46 "audit:prod": "npm audit --omit=dev --audit-level=high",

47 "eval:retrieval": "npm run build && node scripts/eval-retrieval.mjs",

48 "eval:retrieval:quality": "npm run build && node scripts/eval-retrieval-quality.mjs",

49 "eval:knowledge": "npm run build && node scripts/eval-knowledge.mjs",

50 "eval:agent": "npm run build && node scripts/eval-agent.mjs"

51 },

52 "devDependencies": {

53 "@electric-sql/pglite-socket": "^0.2.13",

54 "@types/node": "^24.0.0",

55 "typescript": "^5.8.0",

56 "vitest": "^3.1.0"

57 },

58 "dependencies": {

59 "@electric-sql/pglite": "^0.5.10",

60 "@electric-sql/pglite-pgvector": "^0.0.11",

61 "@huggingface/transformers": "^4.3.1",

62 "markdown-it": "^15.0.3",

63 "postgres": "^3.4.9"

scripts/postinstall.mjsView file

Lines 1-15javascript

1import { basename, dirname } from "node:path";

2import { fileURLToPath } from "node:url";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

4const packageRoot =

dist/src/skills.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, readfilesync } from "node:fs"; import { cp, lstat, mkdir, readfile, readlink, rm, stat, symlink, writefile } from "node:fs/promises"; import { installagentcontext } from "./agent-context.js"; import { dirname, join, relative, resolve } from "node:path"; import { fileurltopath } from "node:url"; import { skillspath, internal_dirname } from "./layout.js"; import { ensureignoredentries } from "./workspace-io.js"; export const sk[redacted] = ["claude", "codex"]; export const skill_names = [ "docnexus", "docnexus-extract", "docnexus-ingest", "docnexus-reca

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skills.jsView on unpkg

skills/docnexus-library/scripts/query-documents.mjsView file

•matchType = normalized_sha256 matchedPackage = @rowansenne/docnexus@0.24.3 matchedPath = skills/docnexus-library/scripts/query-documents.mjs matchedIdentity = npm:QHJvd2Fuc2VubmUvZG9jbmV4dXM:0.24.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/docnexus-library/scripts/query-documents.mjsView on unpkg

dist/src/reset.jsView file

•matchType = normalized_sha256 matchedPackage = @rowansenne/docnexus@0.24.3 matchedPath = dist/src/reset.js matchedIdentity = npm:QHJvd2Fuc2VubmUvZG9jbmV4dXM:0.24.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/reset.jsView on unpkg

dist/src/workspace-git.jsView file

•matchType = normalized_sha256 matchedPackage = @rowansenne/docnexus@0.24.3 matchedPath = dist/src/workspace-git.js matchedIdentity = npm:QHJvd2Fuc2VubmUvZG9jbmV4dXM:0.24.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/workspace-git.jsView on unpkg

dist/src/postgres-engine.jsView file

•matchType = normalized_sha256 matchedPackage = @rowansenne/docnexus@0.24.3 matchedPath = dist/src/postgres-engine.js matchedIdentity = npm:QHJvd2Fuc2VubmUvZG9jbmV4dXM:0.24.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/postgres-engine.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L1: import { basename, dirname } from "node:path"; L2: import { fileURLToPath } from "node:url"; Referenced control path from dist/src/legacy-cleanup.js: L91: if (marker?.format_version !== PROJECT_FORMAT_VERSION) { L92: for (const file of ["AGENTS.md", "CLAUDE.md"]) L93: await assertNoSymbolicLinks(root, file); Write operation from dist/src/skills.js: L29: export function agentSkillsDirectory(projectRoot, target) { L30: return join(projectRoot, target === "codex" ? ".agents" : ".claude", "skills"); L31: } ... L74: const destination = skillsPath(projectRoot); L75: await mkdir(destination, { recursive: true }); L76: for (const skill of SKILL_NAMES) { L77: await rm(join(destination, s

Findings

1 Critical6 High4 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/skills.js

HighKnown Malware Source Similarityskills/docnexus-library/scripts/query-documents.mjs

HighKnown Malware Source Similaritydist/src/reset.js

HighKnown Malware Source Similaritydist/src/workspace-git.js

HighKnown Malware Source Similaritydist/src/postgres-engine.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @rowansenne/docnexus@0.25.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @rowansenne/docnexus@0.25.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 02:11:02.499Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

18 known versions

0.25.0latestshownMaliciousDestructive ActionBlockPublishedOct 22, 2026, 2:08 AM 0.24.3MaliciousDestructive ActionBlockPublishedOct 21, 2026, 4:49 PM 0.24.2SuspiciousDestructive ActionWarnPublishedOct 21, 2026, 12:37 PM 0.23.0Clean—AllowPublishedOct 18, 2026, 3:36 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other destructive action packages

Behavioral surface

Related packages

Other destructive action packages

Source & flagged code