registry / Destructive action / @rowansenne/docnexus / 0.24.2

@rowansenne/docnexus@0.24.2

[English README](./README.md)

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The postinstall hook can delete recognized legacy DocNexus data without migration or confirmation, creating a concrete data-loss risk. Its narrow product-specific scope makes malicious intent unproven, so this warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing the package as a local project dependency when a recognized legacy DocNexus directory exists.

Impact

Existing DocNexus project data may be lost during installation.

Mechanism

The postinstall hook calls cleanupLegacyProject, which recursively removes legacy workspace data and removes non-allowlisted entries from the internal directory.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/src/legacy-cleanup.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.mjs on installation.
The install hook invokes cleanupLegacyProject for a local project installation.
The cleanup recognizes older DocNexus project formats and can recursively remove legacy project data without migration.
The cleanup also removes entries from .docnexus that are outside its installation allowlist.

Evidence against

Agent skill linking and instruction-file updates occur through the explicit skills link command, not the install hook.
The cleanup is restricted to identified DocNexus legacy directories; the source does not show broad deletion outside them.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 369 KB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged

package.jsonView file

Lines 23-63json

23 "viewer",

24 "skills",

25 "scripts/postinstall.mjs",

26 "README.md",

27 "README.zh-CN.md",

28 "CHANGELOG.md",

29 "LICENSE",

30 "SECURITY.md",

31 "docs",

32 "!docs/operations/baselines"

33 ],

34 "publishConfig": {

35 "access": "public"

36 },

37 "bin": {

38 "docnexus": "dist/src/cli.js"

39 },

40 "scripts": {

41 "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json && node -e \"require('node:fs').chmodSync('dist/src/cli.js', 0o755)\"",

42 "prepack": "npm run build",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "vitest run",

45 "typecheck": "tsc -p tsconfig.json --noEmit",

46 "audit:prod": "npm audit --omit=dev --audit-level=high",

47 "eval:retrieval": "npm run build && node scripts/eval-retrieval.mjs",

48 "eval:retrieval:quality": "npm run build && node scripts/eval-retrieval-quality.mjs",

49 "eval:knowledge": "npm run build && node scripts/eval-knowledge.mjs",

50 "eval:agent": "npm run build && node scripts/eval-agent.mjs"

51 },

52 "devDependencies": {

53 "@electric-sql/pglite-socket": "^0.2.13",

54 "@types/node": "^24.0.0",

55 "typescript": "^5.8.0",

56 "vitest": "^3.1.0"

57 },

58 "dependencies": {

59 "@electric-sql/pglite": "^0.5.10",

60 "@electric-sql/pglite-pgvector": "^0.0.11",

61 "@huggingface/transformers": "^4.3.1",

62 "markdown-it": "^15.0.3",

63 "postgres": "^3.4.9"

scripts/postinstall.mjsView file

Lines 1-15javascript

1import { basename, dirname } from "node:path";

2import { fileURLToPath } from "node:url";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

4const packageRoot =

dist/src/skills.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, readfilesync } from "node:fs"; import { cp, lstat, mkdir, readfile, readlink, rm, stat, symlink, writefile } from "node:fs/promises"; import { installagentcontext } from "./agent-context.js"; import { dirname, join, relative, resolve } from "node:path"; import { fileurltopath } from "node:url"; import { skillspath, internal_dirname } from "./layout.js"; import { ensureignoredentries } from "./workspace-io.js"; export const sk[redacted] = ["claude", "codex"]; export const skill_names = [ "docnexus", "docnexus-extract", "docnexus-ingest", "docnexus-reca

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skills.jsView on unpkg

dist/src/reset.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rowansenne/docnexus@0.23.0 matchedIdentity = npm:QHJvd2Fuc2VubmUvZG9jbmV4dXM:0.23.0 similarity = 0.737 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/reset.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L1: import { basename, dirname } from "node:path"; L2: import { fileURLToPath } from "node:url"; Referenced control path from dist/src/legacy-cleanup.js: L91: if (marker?.format_version !== PROJECT_FORMAT_VERSION) { L92: for (const file of ["AGENTS.md", "CLAUDE.md"]) L93: await assertNoSymbolicLinks(root, file); Write operation from dist/src/skills.js: L29: export function agentSkillsDirectory(projectRoot, target) { L30: return join(projectRoot, target === "codex" ? ".agents" : ".claude", "skills"); L31: } ... L74: const destination = skillsPath(projectRoot); L75: await mkdir(destination, { recursive: true }); L76: for (const skill of SKILL_NAMES) { L77: await rm(join(destination, s

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/skills.js

HighPrevious Version Dangerous Deltadist/src/reset.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @rowansenne/docnexus@0.24.2.

See all versions of @rowansenne/docnexus for other recorded verdicts.

Review the evidence and your use of @rowansenne/docnexus@0.24.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 13:06:20.132Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.