Loading npm security reports…

@vaibot/codex-circuitbreaker-plugin@1.3.0: AI-agent | LPM Firewall

registry / @vaibot/codex-circuitbreaker-plugin / 1.3.0

@vaibot/codex-circuitbreaker-plugin@1.3.0

VAIBot AI agent governance for Codex CLI — intercepts tool calls, classifies risk, enforces policy, and creates tamper-evident audit receipts with on-chain provenance anchoring.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A normal npm install runs postinstall, which writes the user's Codex config without consent. It enables Codex hooks and points an MCP server at the publisher's API.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install lifecycle postinstall, unless CODEX_PLUGIN_INSTALL or VAIBOT_SKIP_POSTINSTALL is already true.

Impact

Codex sessions pick up publisher-controlled hook and MCP routing without an install-time consent prompt.

Mechanism

The script mkdir's ~/.codex and upserts managed blocks into ~/.codex/config.toml setting codex_hooks true and mcp_servers.vaibot to https://api.vaibot.io/v2/mcp.

Policy narrative

Installing @vaibot/codex-circuitbreaker-plugin runs postinstall even when the command fails (|| true). Unless two opt-out environment variables are already set, the script creates ~/.codex and rewrites config.toml. It forces codex_hooks on and registers an HTTP MCP server at https://api.vaibot.io/v2/mcp. That is an unconsented change to Codex's agent control surface during package install, not a user-run setup command.

AI rationale

The postinstall hook mutates the foreign Codex config at ~/.codex/config.toml by default, enabling hooks and a publisher MCP endpoint with no consent prompt. Opt-out environment variables do not make that install-time write consented.

Evidence

package.jsonscripts/postinstall.mjs~/.codex/config.toml

Network endpoints1

api.vaibot.io/v2/mcp

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

vendor/vaibot-guard/scripts/vaibot-guard.mjsView file

11import http from "node:http"; L12: import { spawn } from "node:child_process"; L13: import fs from "node:fs";

High

Child Process

Package source references child process execution.

vendor/vaibot-guard/scripts/vaibot-guard.mjsView on unpkg · L11

•matchType = previous_version_dangerous_delta matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.0.0 matchedIdentity = npm:[redacted]:1.0.0 similarity = 0.474 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

vendor/vaibot-guard/scripts/vaibot-guard.mjsView on unpkg

vendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1View file

10L11: import http from "node:http"; L12: import { spawn } from "node:child_process"; L13: import fs from "node:fs"; ... L19: L20: const GUARD_HOST = process.env.VAIBOT_GUARD_HOST || "127.0.0.1"; L21:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

vendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1View on unpkg · L10

scripts/postinstall.mjsView file

4* L5: * Idempotent. Adds two managed blocks to ~/.codex/config.toml so Codex picks L6: * up the plugin's hooks and the VAIBot MCP server on next session. Both blocks ... L18: * Note: when installed via `codex plugin marketplace add`, Codex itself loads L19: * the plugin's hooks/hooks.json + .mcp.json automatically — this postinstall L20: * is mainly a safety net for direct/local installs and for users who want to ... L26: L27: import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs' L28: import { homedir } from 'node:os' ... L30: L31: const CONFIG_DIR = join(homedir(), '.codex') L32: const CONFIG_FILE = join(CONFIG_DIR, 'config.toml')

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

scripts/pre-tool-use.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/pre-tool-use.mjs#virtual:normalized:round1View on unpkg

vendor/vaibot-guard/scripts/vaibot-guard-exec.mjsView file

•matchType = normalized_sha256 matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.2.0 matchedPath = vendor/vaibot-guard/scripts/vaibot-guard-exec.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/vaibot-guard/scripts/vaibot-guard-exec.mjsView on unpkg

vendor/vaibot-guard/scripts/lib/guard-launch.mjsView file

•matchType = normalized_sha256 matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.2.0 matchedPath = vendor/vaibot-guard/scripts/lib/guard-launch.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/vaibot-guard/scripts/lib/guard-launch.mjsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 19-45json

19 "provenance",

20 "guardrails"

21 ],

22 "type": "module",

23 "private": false,

24 "devDependencies": {

25 "@vaibot/guard": "workspace:*"

26 },

27 "files": [

28 ".agents/",

29 ".codex-plugin/",

30 "hooks/",

31 "scripts/",

32 "vendor/",

33 ".mcp.json",

34 "README.md",

35 "LICENSE"

36 ],

37 "scripts": {

38 "test": "node --test 'test/*.test.mjs'",

39 "postinstall": "node ./scripts/postinstall.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 },

41 "engines": {

42 "node": ">=20"

43 }

44}

45

vendor/vaibot-guard/scripts/vaibot-guard.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * vaibot-guard (MVP CLI)

4 *

5 * Implements the interface described in SKILL.md:

6 * - vaibot-guard precheck --intent '<json>'

7 * - vaibot-guard exec --intent '<json>' -- <command...>

8 * - vaibot-guard finalize --run_id <id> --result '<json>'

9 */

10

11import

vendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1View file

10L11: import http from "node:http"; L12: import { spawn } from "node:child_process"; L13: import fs from "node:fs"; ... L19: L20: const GUARD_HOST = process.env.VAIBOT_GUARD_HOST || "127.0.0.1"; L21:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

vendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1View on unpkg · L10

scripts/postinstall.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script for @vaibot/codex-circuitbreaker-plugin.

4 *

5 * Idempotent. Adds two managed blocks to ~/.codex/config.toml so Codex picks

6 * up the plugin's hooks and the VAIBot MCP server on next session. Both blocks

7 * are wrapped with comment markers so user edits between markers never get

8 * overwritten.

9 *

10 * 1. [features] codex_hooks = true

scripts/pre-tool-use.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/pre-tool-use.mjs#virtual:normalized:round1View on unpkg

vendor/vaibot-guard/scripts/vaibot-guard-exec.mjsView file

•matchType = normalized_sha256 matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.2.0 matchedPath = vendor/vaibot-guard/scripts/vaibot-guard-exec.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/vaibot-guard/scripts/vaibot-guard-exec.mjsView on unpkg

vendor/vaibot-guard/scripts/lib/guard-launch.mjsView file

•matchType = normalized_sha256 matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.2.0 matchedPath = vendor/vaibot-guard/scripts/lib/guard-launch.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/vaibot-guard/scripts/lib/guard-launch.mjsView on unpkg