Loading npm security reports…

@vaibot/codex-circuitbreaker-plugin@1.3.2: AI-agent | LPM Firewall

registry / @vaibot/codex-circuitbreaker-plugin / 1.3.2

@vaibot/codex-circuitbreaker-plugin@1.3.2

VAIBot AI agent governance for Codex CLI — intercepts tool calls, classifies risk, enforces policy, and creates tamper-evident audit receipts with on-chain provenance anchoring.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically changes the user's global Codex configuration. It enables hooks and registers a remote VAIBot MCP service.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall execution during package installation.

Impact

A package installation changes a broad AI-agent control surface and causes later Codex sessions to load the configured remote MCP integration.

Mechanism

The postinstall script edits the Codex configuration and inserts managed feature and MCP-server blocks.

Policy narrative

The package runs a postinstall hook without an interactive consent step. That hook edits the user's global Codex configuration, enables hooks, and registers the package operator's remote MCP endpoint. This is an unconsented install-time mutation of a broad AI-agent control surface, which can affect later sessions beyond the package installation itself.

AI rationale

The automatic lifecycle hook mutates global Codex agent configuration and registers a remote MCP service. This meets the blocking policy for unconsented postinstall control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjs

Network endpoints1

api.vaibot.io/v2/mcp

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

vendor/vaibot-guard/scripts/vaibot-guard.mjsView file

11import http from "node:http"; L12: import { spawn } from "node:child_process"; L13: import fs from "node:fs";

High

Child Process

Package source references child process execution.

vendor/vaibot-guard/scripts/vaibot-guard.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.3.0 matchedPath = vendor/vaibot-guard/scripts/vaibot-guard.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/vaibot-guard/scripts/vaibot-guard.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.0.0 matchedIdentity = npm:[redacted]:1.0.0 similarity = 0.368 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

vendor/vaibot-guard/scripts/vaibot-guard.mjsView on unpkg

vendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1View file

10L11: import http from "node:http"; L12: import { spawn } from "node:child_process"; L13: import fs from "node:fs"; ... L19: L20: const GUARD_HOST = process.env.VAIBOT_GUARD_HOST || "127.0.0.1"; L21:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

vendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1View on unpkg · L10

scripts/postinstall.mjsView file

4* L5: * Idempotent. Adds two managed blocks to ~/.codex/config.toml so Codex picks L6: * up the plugin's hooks and the VAIBot MCP server on next session. Both blocks ... L18: * Note: when installed via `codex plugin marketplace add`, Codex itself loads L19: * the plugin's hooks/hooks.json + .mcp.json automatically — this postinstall L20: * is mainly a safety net for direct/local installs and for users who want to ... L26: L27: import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs' L28: import { homedir } from 'node:os' ... L30: L31: const CONFIG_DIR = join(homedir(), '.codex') L32: const CONFIG_FILE = join(CONFIG_DIR, 'config.toml')

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

scripts/pre-tool-use.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/pre-tool-use.mjs#virtual:normalized:round1View on unpkg

vendor/vaibot-guard/scripts/vaibot-guard-exec.mjsView file

•matchType = normalized_sha256 matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.3.0 matchedPath = vendor/vaibot-guard/scripts/vaibot-guard-exec.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/vaibot-guard/scripts/vaibot-guard-exec.mjsView on unpkg

vendor/vaibot-guard/scripts/lib/guard-launch.mjsView file

•matchType = normalized_sha256 matchedPackage = @vaibot/codex-circuitbreaker-plugin@1.3.0 matchedPath = vendor/vaibot-guard/scripts/lib/guard-launch.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/vaibot-guard/scripts/lib/guard-launch.mjsView on unpkg