registry / @walkhi/code-relax / 0.1.0-beta.30

@walkhi/code-relax@0.1.0-beta.30

Code Relax Windows and macOS workstation service

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The global postinstall automatically enables a persistent service and installs a first-party agent skill, which warrants a warning for extension lifecycle risk. The inspected account presence handshake is reached through the schedules request and does not establish a separate attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The package postinstall hook runs during a global npm install.

Impact

The service persists across logins and the agent can load the installed skill; no private-content export was established.

Mechanism

The hook invokes setup, which enables login startup and installs the package-owned skill under the user’s agent skills directory.

AI rationale

Evidence

package.jsontools/postinstall.mjsdist/bin/codex-remote.mjsdist/src/skill-install.mjs

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest declares a postinstall hook and exposes the package CLI.
The hook runs setup only when invoked directly during a global npm install; setup enables login startup and installs the package’s own skill.
The skill installer targets the package-specific agent skills directory and refuses to replace an unmanaged skill.
A schedules GET request connects the Dots room client to chatgpt.com; on socket open it sends background presence and subscribes to its configured topic.

Evidence against

The inspected setup installs a package-owned skill in its own directory; the source does not establish a broad agent settings change or private-content export.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

19 flagged

package.jsonView file

Lines 1-28json

2 "name": "@walkhi/code-relax",

3 "version": "0.1.0-beta.30",

4 "private": false,

5 "license": "UNLICENSED",

6 "type": "module",

7 "scripts": {

8 "postinstall": "node ./tools/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

10 "dependencies": {

11 "mysql2": "^3.24.4",

12 "node-datachannel": "0.33.4",

13 "qrcode": "1.5.4",

14 "sharp": "0.35.5",

15 "ws": "8.21.3"

16 },

17 "bin": {

18 "relax": "dist/bin/codex-remote.mjs",

19 "code-relax": "dist/bin/codex-remote.mjs"

20 },

21 "description": "Code Relax Windows and macOS workstation service",

22 "engines": {

23 "node": ">=22.12.0"

24 },

25 "os": [

26 "win32",

27 "darwin"

28 ],

dist/src/platform/windows/rustdesk-video-probe.mjsView file

Lines 1-22javascript

1import crypto from 'node:crypto';

2import fs from 'node:fs';

3import net from 'node:net';

4import os from 'node:os'

tools/postinstall.mjsView file

Lines 1-28javascript

1import { execFileSync } from 'node:child_process';

2import fs from 'node:fs';

High

Child Process

Package source references child process execution.

tools/postinstall.mjsView on unpkg · L1

3import os from 'node:os';

4import

dist/src/server.mjsView file

Lines 1-23javascript

1import crypto from 'node:crypto';

2import { RustDeskVideoProbe } from './platform/windows/rustdesk-video-probe.mjs';

3import fs from 'node:fs';

4import http from 'node:http';

dist/src/platform/macos/resident-startup.mjsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import { execFile } from 'node:child_process'

dist/src/platform/windows/desktop-helper.mjsView file

1import net from 'node:net'; L2: import fs from 'node:fs'; L3: import path from 'node:path'; L4: import { execFile } from 'node:child_process'; L5: import { promisify } from 'node:util'; ... L10: const binary = fileURLToPath(new URL('../../../native/desktop-helper/CodeRelaxDesktop.exe', import.meta.url)); L11: const powershell = path.join(process.env.SystemRoot || 'C:/Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe'); L12: const quote = value => `'${String(value).replaceAll("'", "''")}'`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/platform/windows/desktop-helper.mjsView on unpkg · L1

dist/src/skill-install.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import os from 'node:os'; import { createhash } from 'node:crypto'; import { readrecord, writerecord } from './service-lifecycle.mjs'; const owner = '@walkhi/code-relax'; const markername = '.code-relax-install.json'; const digest = value => createhash('sha256').update(value).digest('hex'); export const sk[redacted] = (home = os.homedir()) => path.join(home, '.agents/skills/code-relax'); export function assertplainpath(target) { for (let item = path.resolve(target); ; item = path.dirname(item)) { try { if (fs.lstatsync(i

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skill-install.mjsView on unpkg

dist/tools/rtc-route-helper.ps1View file

•path = dist/tools/rtc-route-helper.ps1 kind = build_helper sizeBytes = 5267 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/tools/rtc-route-helper.ps1View on unpkg

dist/shared/code-browser.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/shared/code-browser.cjs#virtual:normalized:round1View on unpkg

dist/src/background-process.mjsView file

•matchType = normalized_sha256 matchedPackage = @walkhi/code-relax@0.1.0-beta.1 matchedPath = dist/src/background-process.mjs matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High