Loading npm security reports…

@walkhi/code-relax@0.1.0-beta.1: AI-agent control-surface risk | LPM Firewall

registry / @walkhi/code-relax / 0.1.0-beta.1

@walkhi/code-relax@0.1.0-beta.1

Windows Code Relax LAN Bridge and CLI

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global installation automatically changes the user-wide Codex app-server connection setting. This affects a foreign agent control surface beyond the package's own extension directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global npm installation followed by successful automatic setup.

Impact

Future Codex launches connect to the managed local app-server; setup also enables startup.

Mechanism

Postinstall invokes setup, which persists CODEX_APP_SERVER_WS_URL through PowerShell without a separate confirmation.

Policy narrative

Global installation automatically invokes setup. Once the managed app-server is ready, setup enables startup and writes a persistent user-wide Codex connection setting. The existing-value guard limits overwrites but still permits automatic mutation when the setting is absent. This crosses the boundary from package-owned setup into changing another agent's control surface without explicit confirmation.

AI rationale

The inspected lifecycle chain performs an unconsented install-time mutation of a foreign AI-agent control surface, meeting the blocking policy. The local destination and overwrite guard limit the impact but do not remove that behavior.

Evidence

package.jsontools/postinstall.mjsdist/bin/codex-remote.mjsdist/src/platform/windows/user-environment.mjsdist/src/platform/windows/user-environment.ps1dist/src/managed-app-server.mjsmanaged-environment.json

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./tools/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./tools/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

tools/postinstall.mjsView file

1import { execFileSync } from 'node:child_process'; L2: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

tools/postinstall.mjsView on unpkg · L1

dist/src/server.mjsView file

2import fs from 'node:fs'; L3: import http from 'node:http'; L4: import net from 'node:net'; ... L58: const options = parseOptions(process.argv.slice(2)); L59: const pipePath = process.env.CODEX_APP_TOOLS_PIPE_PATH?.trim(); L60: let sourceThreadId = (process.env.CODEX_THREAD_ID || process.env.CODEX_SESSION_ID)?.trim(); ... L63: const repositoryRoot = path.resolve(webRoot, '..', '..'); L64: const projectRoot = os.homedir(); L65: const { codexDataRoot, stateRoot, sessionsRoot, uploadsRoot } = runtimePaths(); ... L75: const allowedUploadsRoots = [uploadsRoot, legacyUploadsRoot, L76: ...JSON.parse(process.env.CODEX_REMOTE_LEGACY_UPLOADS_ROOTS || '[]')]; L77: const sessionPathCache = new Map();

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/server.mjsView on unpkg · L2

2import fs from 'node:fs'; L3: import http from 'node:http'; L4: import net from 'node:net'; ... L58: const options = parseOptions(process.argv.slice(2)); L59: const pipePath = process.env.CODEX_APP_TOOLS_PIPE_PATH?.trim(); L60: let sourceThreadId = (process.env.CODEX_THREAD_ID || process.env.CODEX_SESSION_ID)?.trim(); ... L63: const repositoryRoot = path.resolve(webRoot, '..', '..'); L64: const projectRoot = os.homedir(); L65: const { codexDataRoot, stateRoot, sessionsRoot, uploadsRoot } = runtimePaths(); ... L75: const allowedUploadsRoots = [uploadsRoot, legacyUploadsRoot, L76: ...JSON.parse(process.env.CODEX_REMOTE_LEGACY_UPLOADS_ROOTS || '[]')]; L77: const sessionPathCache = new Map();

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/src/server.mjsView on unpkg · L2

node_modules/ws/lib/websocket-server.jsView file

5const EventEmitter = require('events'); L6: const http = require('http'); L7: const { Duplex } = require('stream'); ... L109: }); L110: res.end(body); L111: }); ... L369: * @throws {Error} If called more than once with the same socket L370: * @private L371: */ ... L388: .update(key + GUID) L389: .digest('base64'); L390:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

node_modules/ws/lib/websocket-server.jsView on unpkg · L5

dist/src/platform/windows/desktop-host.mjsView file

8const directory = path.dirname(fileURLToPath(import.meta.url)); L9: export const powershell = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe'); L10: export async function runScript(name, args = []) { ... L20: stop: pid => process.kill(pid), L21: ready: async url => { try { return (await fetch(url, { signal: AbortSignal.timeout(1000) })).ok; } catch { return false; } }, L22: };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/platform/windows/desktop-host.mjsView on unpkg · L8

dist/bin/codex-remote.mjsView file

58Install-time code directly mutates a foreign AI-agent control surface: L170: const source = path.join(stateRoot, name), target = path.join(physicalStateRoot, name); L171: if (fs.existsSync(source) && !fs.existsSync(target)) fs.copyFileSync(source, target, fs.constants.COPYFILE_EXCL); L172: } ... L230: desktop = await launchDesktop(command === 'shared-start' ? 'shared' : 'ordinary', { stateRoot, host: desktopHost }); L231: delete process.env.CODEX_APP_TOOLS_PIPE_PATH; L232: } Write operation from dist/bin/codex-remote.mjs: L170: const source = path.join(stateRoot, name), target = path.join(physicalStateRoot, name); L171: if (fs.existsSync(source) && !fs.existsSync(target)) fs.copyFileSync(source, target, fs.constants.COPYFILE_EXCL); L172: } ... L230: desktop = await launchDesktop(command ==

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/bin/codex-remote.mjsView on unpkg · L58

dist/src/skill-install.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import os from 'node:os'; import { createhash } from 'node:crypto'; import { readrecord, writerecord } from './service-lifecycle.mjs'; const owner = '@walkhi/code-relax'; const markername = '.code-relax-install.json'; const legacyowner = '@closedhi/codex-remote'; const legacymarkername = '.codex-remote-install.json'; const digest = value => createhash('sha256').update(value).digest('hex'); export const sk[redacted] = (home = os.homedir()) => path.join(home, '.agents/skills/code-relax'); const legacyskilldirectory = (home = os.homedir()) => path.join(home, '.agents/skills/codex-remote');

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skill-install.mjsView on unpkg

node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.nodeView file

•path = node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.node kind = native_binary sizeBytes = 442368 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.nodeView on unpkg

dist/tools/rtc-route-helper.ps1View file

•path = dist/tools/rtc-route-helper.ps1 kind = build_helper sizeBytes = 5168 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/tools/rtc-route-helper.ps1View on unpkg

dist/web/vendor/markdown-it.umd.min.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web/vendor/markdown-it.umd.min.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "@walkhi/code-relax",

3 "version": "0.1.0-beta.1",

4 "license": "UNLICENSED",

5 "type": "module",

6 "scripts": {

7 "postinstall": "node ./tools/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 "relay:demo": "node ./bin/self-relay-demo.mjs",

9 "relay:check": "node ./bin/self-relay-demo.mjs --check",

10 "probe:app-server": "node ./tools/probe-app-server.mjs",

11 "probe:app-server-tasks": "node ./tools/probe-app-server-tasks.mjs",

12 "build": "node ./tools/build-package.mjs",

13 "prepack": "npm run build"

14 },

15 "dependencies": {

16 "node-datachannel": "0.33.4",

17 "qrcode": "1.5.4",

18 "sharp": "0.35.4",

19 "ws": "8.21.3"

20 },

21 "bin": {

22 "relax": "dist/bin/codex-remote.mjs",

23 "code-relax": "dist/bin/codex-remote.mjs"

24 },

25 "description": "Windows Code Relax LAN Bridge and CLI",

26 "engines": {

27 "node": ">=22.12.0"

tools/postinstall.mjsView file

Lines 1-10javascript

1import { execFileSync } from 'node:child_process';

2import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

tools/postinstall.mjsView on unpkg · L1

3

4if (process.env.npm_config_global === 'true') {

dist/src/server.mjsView file

Lines 1-22javascript

1import crypto from 'node:crypto';

2import fs from 'node:fs';

3import http from 'node:http';

4import net from 'node:net';

node_modules/ws/lib/websocket-server.jsView file

Lines 1-25javascript

1/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex$", "caughtErrors": "none" }] */

2

3'use strict';

4

5const EventEmitter = require('events');

6const http = require

dist/src/platform/windows/desktop-host.mjsView file

Lines 1-28javascript

1import { startWindowsProcess } from './background-process.mjs';

2import { execFile } from 'node:child_process';

3import { promisify } from 'node:util';

4import { fileURLToPath } from 'node:url'

dist/bin/codex-remote.mjsView file

Lines 38-78javascript

38 relay-shared-start 启动完整控制和 Bridge 后连接私有中继（需先退出当前 Codex）

39 relay-status 查看私有中继连接器及手机连接状态

40 relay-stop 停止私有中继连接器，不停止 Bridge 或 Codex

41 relay-revoke 撤销这台电脑的全部移动设备授权（停止连接器不会撤销授权）

42 doctor 检查安装、Node、Desktop、网络和 Skill，提示防火墙处理方式

43 skill-install 安装/

dist/src/skill-install.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import os from 'node:os'; import { createhash } from 'node:crypto'; import { readrecord, writerecord } from './service-lifecycle.mjs'; const owner = '@walkhi/code-relax'; const markername = '.code-relax-install.json'; const legacyowner = '@closedhi/codex-remote'; const legacymarkername = '.codex-remote-install.json'; const digest = value => createhash('sha256').update(value).digest('hex'); export const sk[redacted] = (home = os.homedir()) => path.join(home, '.agents/skills/code-relax'); const legacyskilldirectory = (home = os.homedir()) => path.join(home, '.agents/skills/codex-remote');

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skill-install.mjsView on unpkg

node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.nodeView file

•path = node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.node kind = native_binary sizeBytes = 442368 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64-0.35.4.nodeView on unpkg

dist/tools/rtc-route-helper.ps1View file

•path = dist/tools/rtc-route-helper.ps1 kind = build_helper sizeBytes = 5168 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/tools/rtc-route-helper.ps1View on unpkg

dist/web/vendor/markdown-it.umd.min.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web/vendor/markdown-it.umd.min.jsView on unpkg