registry / AI-agent control-surface risk / @walkhi/code-relax

@walkhi/code-relax

Windows Code Relax LAN Bridge and CLI

This report shows the evidence for @walkhi/code-relax@0.1.0-beta.1. 1 of 24 known versions is blocked or flagged. The newest version, 0.1.0-beta.71, is flagged. See all versions.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The inspected lifecycle chain performs an unconsented install-time mutation of a foreign AI-agent control surface, meeting the blocking policy. The local destination and overwrite guard limit the impact but do not remove that behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global npm installation followed by successful automatic setup.

Impact

Future Codex launches connect to the managed local app-server; setup also enables startup.

Mechanism

Postinstall invokes setup, which persists CODEX_APP_SERVER_WS_URL through PowerShell without a separate confirmation.

Policy narrative

Global installation automatically invokes setup. Once the managed app-server is ready, setup enables startup and writes a persistent user-wide Codex connection setting. The existing-value guard limits overwrites but still permits automatic mutation when the setting is absent. This crosses the boundary from package-owned setup into changing another agent's control surface without explicit confirmation.

AI rationale

Evidence

package.jsontools/postinstall.mjsdist/bin/codex-remote.mjsdist/src/platform/windows/user-environment.mjsdist/src/platform/windows/user-environment.ps1dist/src/managed-app-server.mjsmanaged-environment.json

Network endpoints1

ws://127.0.0.1:45839

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json registers an automatic postinstall hook.
On global installation, postinstall runs setup and skill-install without a confirmation flag.
Setup enables startup and calls configureManagedEnvironment automatically.
The environment helper sets CODEX_APP_SERVER_WS_URL to the managed server address.
PowerShell persists the connection setting in the user-wide environment and broadcasts the change.
The destination is the local managed app-server at ws://127.0.0.1:45839.

Evidence against

The helper refuses to overwrite a different existing user connection setting.
The destination is local; the inspected chain does not establish credential exfiltration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

12 flagged

package.jsonView file

Lines 1-27json

2 "name": "@walkhi/code-relax",

3 "version": "0.1.0-beta.1",

4 "license": "UNLICENSED",

5 "type": "module",

6 "scripts": {

7 "postinstall": "node ./tools/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 "relay:demo": "node ./bin/self-relay-demo.mjs",

9 "relay:check": "node ./bin/self-relay-demo.mjs --check",

10 "probe:app-server": "node ./tools/probe-app-server.mjs",

11 "probe:app-server-tasks": "node ./tools/probe-app-server-tasks.mjs",

12 "build": "node ./tools/build-package.mjs",

13 "prepack": "npm run build"

14 },

15 "dependencies": {

16 "node-datachannel": "0.33.4",

17 "qrcode": "1.5.4",

18 "sharp": "0.35.4",

19 "ws": "8.21.3"

20 },

21 "bin": {

22 "relax": "dist/bin/codex-remote.mjs",

23 "code-relax": "dist/bin/codex-remote.mjs"

24 },

25 "description": "Windows Code Relax LAN Bridge and CLI",

26 "engines": {

27 "node": ">=22.12.0"

tools/postinstall.mjsView file

Lines 1-10javascript

1import { execFileSync } from 'node:child_process';

2import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

tools/postinstall.mjsView on unpkg · L1

4if (process.env.npm_config_global === 'true') {

dist/src/server.mjsView file

Lines 1-22javascript

1import crypto from 'node:crypto';

2import fs from 'node:fs';

3import http from 'node:http';

4import net from 'node:net';

node_modules/ws/lib/websocket-server.jsView file

Lines 1-25javascript

1/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex$", "caughtErrors": "none" }] */

3'use strict';

5const EventEmitter = require('events');

6const http = require

dist/src/platform/windows/desktop-host.mjsView file

Lines 1-28javascript

1import { startWindowsProcess } from './background-process.mjs';

2import { execFile } from 'node:child_process';

3import { promisify } from 'node:util';

4import { fileURLToPath } from 'node:url'

dist/bin/codex-remote.mjsView file

Lines 38-78javascript

38 relay-shared-start 启动完整控制和 Bridge 后连接私有中继（需先退出当前 Codex）

39 relay-status 查看私有中继连接器及手机连接状态

40 relay-stop 停止私有中继连接器，不停止 Bridge 或 Codex

41 relay-revoke 撤销这台电脑的全部移动设备授权（停止连接器不会撤销授权）

42 doctor 检查安装、Node、Desktop、网络和 Skill，提示防火墙处理方式

43 skill-install 安装/

dist/src/skill-install.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import os from 'node:os'; import { createhash } from 'node:crypto'; import { readrecord, writerecord } from './service-lifecycle.mjs'; const owner = '@walkhi/code-relax'; const markername = '.code-relax-install.json'; const legacyowner = '@closedhi/codex-remote'; const legacymarkername = '.codex-remote-install.json'; const digest = value => createhash('sha256').update(value).digest('hex'); export const sk[redacted] = (home = os.homedir()) => path.join(home, '.agents/skills/code-relax'); const legacyskilldirectory = (home = os.homedir()) => path.join(home, '.agents/skills/codex-remote');

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skill-install.mjsView on unpkg

node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.nodeView file

•path = node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.node kind = native_binary sizeBytes = 442368 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.nodeView on unpkg

dist/tools/rtc-route-helper.ps1View file

•path = dist/tools/rtc-route-helper.ps1 kind = build_helper sizeBytes = 5168 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/tools/rtc-route-helper.ps1View on unpkg

dist/web/vendor/markdown-it.umd.min.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web/vendor/markdown-it.umd.min.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./tools/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./tools/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

tools/postinstall.mjsView file

1import { execFileSync } from 'node:child_process'; L2: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

tools/postinstall.mjsView on unpkg · L1

Findings

1 Critical6 High7 Medium7 Low

CriticalAi Agent Control Hijackdist/bin/codex-remote.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processtools/postinstall.mjs

HighSame File Env Network Executiondist/src/platform/windows/desktop-host.mjs

HighObfuscated Payload Loaderdist/src/server.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/skill-install.mjs

HighSemantic Analysis Limiteddist/web/vendor/markdown-it.umd.min.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumUnsafe Vm Contextdist/src/server.mjs

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @walkhi/code-relax@0.1.0-beta.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @walkhi/code-relax@0.1.0-beta.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 19:59:20.756Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

24 known versions

0.1.0-beta.71latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 8:11 AM 0.1.0-beta.68SuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 5:40 AM 0.1.0-beta.66SuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 4:24 AM 0.1.0-beta.65SuspiciousAgent extension lifecycle riskWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages