@tokensrc/codex@1.14.46: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@tokensrc/codex@1.14.46: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/bin-app.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/bin-app.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = dist/bin-app.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin-app.jsView on unpkg

dist/release-process-shutdown.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tokensrc/codex@1.14.31 matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.31 similarity = 0.922 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/release-process-shutdown.jsView on unpkg

22// Capture a process handle and verify creation time and SID again within L23: // PowerShell. No tree kill: only the explicitly confirmed process is affected. L24: if (!/^\d+$/u.test(item.startedAt))

High

Shell

Package source references shell execution.

dist/release-process-shutdown.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = dist/release-process-shutdown.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/release-process-shutdown.jsView on unpkg

assets/shortcut-bootstrap.cjsView file

408? `trusted Numa ${known.raw} is unavailable or corrupt; refusing to downgrade to ${installed.raw}. Restore network access or reinstall the shortcut from a trusted terminal.` L409: : "no verified local Numa release is available. Re-run `npx -y --prefer-online @numa-tech/numa@latest codex shortcut install` from a terminal with Node and npm."); L410: return; L411: } L412: const child = spawnSync(config.nodeExecutable, [selected, ...args], { L413: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

assets/shortcut-bootstrap.cjsView on unpkg · L408

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = assets/shortcut-bootstrap.cjs matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/shortcut-bootstrap.cjsView on unpkg

dist/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = dist/runtime.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime.jsView on unpkg

dist/bin-run.jsView file

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = dist/bin-app.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin-run.jsView on unpkg

Source & flagged code

9 flagged

dist/bin-app.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/bin-app.jsView on unpkg · L1

4const child = spawn(process.execPath, [fileURLToPath(new URL("./cli.js", import.meta.url)), "app", ...process.argv.slice(2)], {

5 stdio: "inherit",

6 env: process.env

7});

8process.exitCode = await new Promise((resolve, reject) => {

9 child.once("error", reject);

10 child.once("exit", (code, signal) => resolve(signal ? 128 : (code ?? 1)));

11});

12//# sourceMappingURL=bin-app.js.map

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = dist/bin-app.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin-app.jsView on unpkg

dist/release-process-shutdown.jsView file

Lines 2-42javascript

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

4import { inspectCodexReleaseProcesses, describeCodexReleaseProcess } from "./release-processes.js";

5const runFile =

assets/shortcut-bootstrap.cjsView file

Lines 388-428javascript

388 const next = { ...current, nextCheckAt: Date.now() + FAILURE_CHECK_INTERVAL_MS };

389 writeState(config, next);

390 return next;

391 }

dist/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = dist/runtime.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime.jsView on unpkg

dist/bin-run.jsView file

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.34 matchedPath = dist/bin-app.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin-run.jsView on unpkg