registry / @walkhi/code-relax / 0.1.0-beta.31
@walkhi/code-relax@0.1.0-beta.31
⚠ Under reviewCode Relax Windows, macOS and Linux workstation service
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe inspected install, credential, upload, and messaging paths do not establish concrete attack behavior. The package-wide assessment remains inconclusive because bundled artifacts were not fully resolved, so manual review is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Global npm installation runs the guarded postinstall setup; runtime use can connect the Dots messaging client.
Impact
No unauthorized disclosure or account change was established in the reviewed paths; unresolved bundled behavior prevents a conclusive package-wide assessment.
Mechanism
The reviewed code uses the Codex ChatGPT session for ChatGPT backend requests and uploads operation-supplied files. The remaining bundled artifacts were not fully resolved.
AI rationale
The inspected install, credential, upload, and messaging paths do not establish concrete attack behavior. The package-wide assessment remains inconclusive because bundled artifacts were not fully resolved, so manual review is appropriate.
Evidence
dist/shared/code-browser.cjsdist/web/vendor/markdown-it.umd.min.jspackage.jsontools/postinstall.mjsdist/src/dots-task-catalog.mjsdist/src/dots-task-files.mjsdist/src/celsius-client.mjsdist/src/dots-room-client.mjs
Network endpoints2
wss://codex-cloud-backend.chatgpt.com/chatgpt.com
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest defines a postinstall hook; the hook runs setup only when invoked directly during a global npm install.
- The Dots task path obtains the existing ChatGPT session and opens a fixed ChatGPT backend connection.
- The task-send caller passes operation-supplied files to the upload helper; the helper reads those files for upload.
- The messaging client sends background presence and subscribes to its configured initial topics when connected.
- The code-browser and Markdown renderer are bundled artifacts; this inspection did not resolve their complete behavior.
Evidence against
- The inspected credential and file-transfer paths target ChatGPT services, and the install hook has a global-install guard.
- The inspected source did not establish unauthorized credential disclosure or an unrelated account action.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
20 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./tools/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./tools/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/platform/windows/rustdesk-video-probe.mjsView file
77patternName = generic_password
severity = medium
line = 77
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/src/platform/windows/rustdesk-video-probe.mjsView on unpkg · L772import fs from 'node:fs';
L3: import net from 'node:net';
L4: import os from 'node:os';
L5: import path from 'node:path';
L6: import { spawn } from 'node:child_process';
L7: import { brotliDecompressSync } from 'node:zlib';
...
L18: if (crypto.createHash('sha256').update(bytes).digest('hex') !== RUSTDESK_PROBE_HOST_SHA256) throw failure('desktop_video_host_hash');
L19: const magic = Buffer.from('rustdesk'), decoder = new TextDecoder('utf-8', { fatal: true });
L20: let search = 0, entries;
...
L60: export class RustDeskVideoProbe {
L61: constructor({ stateRoot, appData = process.env.APPDATA, platform = process.platform } = {}) {
L62: this.platform = platform;
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/src/platform/windows/rustdesk-video-probe.mjsView on unpkg · L2tools/postinstall.mjsView file
15Install-time AI-agent control hijack evidence:
Install-time helper chain writes an AI-agent control surface:
L26: function appendLog(message) {
L27: fs.mkdirSync(stateRoot, { recursive: true });
L28: fs.appendFileSync(installLog, `${new Date().toISOString()} ${sanitizeLog(message)}\n`, 'utf8');
L29: }
Referenced control path from dist/src/platform/posix/runtime-paths.mjs:
L15: : join(xdgRoot('XDG_STATE_HOME', '.local/state'), 'CodexRemote');
L16: const codexDataRoot = environment.CODEX_HOME?.trim() || join(home, '.codex');
L17: return {
Write operation from tools/postinstall.mjs:
L26: function appendLog(message) {
L27: fs.mkdirSync(stateRoot, { recursive: true });
L28: fs.appendFileSync(installLog, `${new Date().toISOString()} ${sanitizeLog(message)}\n`, 'utf8');
L29: }
Payload evidence fr
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
tools/postinstall.mjsView on unpkg · L151import { execFileSync } from 'node:child_process';
L2: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
tools/postinstall.mjsView on unpkg · L18const pathsModule = new URL('../dist/src/platform/runtime-paths.mjs', import.meta.url);
L9: const { runtimePaths } = await import(fs.existsSync(pathsModule) ? pathsModule : new URL('../src/platform/runtime-paths.mjs', import.meta.url));
L10: const { serviceRoot, stateRoot } = runtimePaths();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
tools/postinstall.mjsView on unpkg · L8dist/src/server.mjsView file
3import fs from 'node:fs';
L4: import http from 'node:http';
L5: import path from 'node:path';
...
L56: const messageReceipts = new messageDelivery.Store();
L57: const desktopHelper = process.platform === 'win32' ? new DesktopHelper() : null;
L58:
...
L81: while (true) {
L82: const manifest = readRecord(path.join(directory, 'package.json'));
L83: if (manifest?.name === '@walkhi/code-relax') return manifest.version || '未知';
...
L93: const webRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'web');
L94: const projectRoot = os.homedir();
L95: const { codexDataRoot, stateRoot, sessionsRoot, uploadsRoot } = runtimePaths();
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/src/server.mjsView on unpkg · L33import fs from 'node:fs';
L4: import http from 'node:http';
L5: import path from 'node:path';
...
L56: const messageReceipts = new messageDelivery.Store();
L57: const desktopHelper = process.platform === 'win32' ? new DesktopHelper() : null;
L58:
...
L81: while (true) {
L82: const manifest = readRecord(path.join(directory, 'package.json'));
L83: if (manifest?.name === '@walkhi/code-relax') return manifest.version || '未知';
...
L93: const webRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'web');
L94: const projectRoot = os.homedir();
L95: const { codexDataRoot, stateRoot, sessionsRoot, uploadsRoot } = runtimePaths();
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/src/server.mjsView on unpkg · L3dist/src/platform/macos/resident-startup.mjsView file
3import path from 'node:path';
L4: import { execFile } from 'node:child_process';
L5: import { promisify } from 'node:util';
...
L30: <key>EnvironmentVariables</key><dict>${Object.entries(variables).map(([key, value]) => `<key>${key}</key><string>${xml(value)}</string>`).join('')}</dict>
L31: <key>StandardOutPath</key><string>${xml(path.join(stateRoot, 'login.stdout.log'))}</string>
L32: <key>StandardErrorPath</key><string>${xml(path.join(stateRoot, 'login.stderr.log'))}</string>
...
L40: if (uid === 0) throw new Error('请以普通 Mac 用户安装 Code Relax，不使用 sudo。');
L41: const home = os.homedir();
L42: const file = path.join(home, 'Library/LaunchAgents', `${launchAgentLabel}.plist`);
...
L47: const { stdout } = await exec('/usr/bin/plutil', ['-convert', 'json', '-o', '-', file], { timeout: 5000
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/src/platform/macos/resident-startup.mjsView on unpkg · L3dist/src/platform/windows/desktop-helper.mjsView file
1import net from 'node:net';
L2: import fs from 'node:fs';
L3: import path from 'node:path';
L4: import { execFile } from 'node:child_process';
L5: import { promisify } from 'node:util';
...
L10: const binary = fileURLToPath(new URL('../../../native/desktop-helper/CodeRelaxDesktop.exe', import.meta.url));
L11: const powershell = path.join(process.env.SystemRoot || 'C:/Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe');
L12: const quote = value => `'${String(value).replaceAll("'", "''")}'`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/platform/windows/desktop-helper.mjsView on unpkg · L1dist/src/skill-install.mjsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import path from 'node:path';
import os from 'node:os';
import { createhash } from 'node:crypto';
import { readrecord, writerecord } from './service-lifecycle.mjs';
const owner = '@walkhi/code-relax';
const markername = '.code-relax-install.json';
const digest = value => createhash('sha256').update(value).digest('hex');
export const sk[redacted] = (home = os.homedir()) => path.join(home, '.agents/skills/code-relax');
export function assertplainpath(target) {
for (let item = path.resolve(target); ; item = path.dirname(item)) {
try { if (fs.lstatsync(item).issymboli
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/src/skill-install.mjsView on unpkgdist/tools/rtc-route-helper.ps1View file
•path = dist/tools/rtc-route-helper.ps1
kind = build_helper
sizeBytes = 5168
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/tools/rtc-route-helper.ps1View on unpkgdist/shared/code-browser.cjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/shared/code-browser.cjs#virtual:normalized:round1View on unpkgdist/src/background-process.mjsView file
•matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = dist/src/background-process.mjs
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/background-process.mjsView on unpkgdist/src/platform/windows/credential-store.mjsView file
•matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = [redacted]-store.mjs
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/platform/windows/credential-store.mjsView on unpkgdist/src/platform/windows/network-info.mjsView file
•matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = [redacted]-info.mjs
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/platform/windows/network-info.mjsView on unpkgdist/src/self-relay/windows-route-helper.mjsView file
•matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = dist/src/self-relay/windows-route-helper.mjs
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/self-relay/windows-route-helper.mjsView on unpkgdist/web/vendor/markdown-it.umd.min.jsView file
•matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = dist/web/vendor/markdown-it.umd.min.js
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web/vendor/markdown-it.umd.min.jsView on unpkgdist/bin/codex-remote.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @walkhi/code-relax@0.1.0-beta.30
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.30
similarity = 0.725
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/codex-remote.mjsView on unpkgFindings
2 Critical11 High9 Medium7 Low
CriticalAi Agent Control Hijacktools/postinstall.mjs
CriticalPrevious Version Dangerous Deltadist/bin/codex-remote.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processtools/postinstall.mjs
HighSame File Env Network Executiondist/src/platform/windows/desktop-helper.mjs
HighObfuscated Payload Loaderdist/src/server.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/skill-install.mjs
HighSemantic Analysis Limiteddist/shared/code-browser.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/background-process.mjs
HighKnown Malware Source Similaritydist/src/platform/windows/credential-store.mjs
HighKnown Malware Source Similaritydist/src/platform/windows/network-info.mjs
HighKnown Malware Source Similaritydist/src/self-relay/windows-route-helper.mjs
HighKnown Malware Source Similaritydist/web/vendor/markdown-it.umd.min.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patterndist/src/platform/windows/rustdesk-video-probe.mjs
MediumDynamic Requiretools/postinstall.mjs
MediumUnsafe Vm Contextdist/src/server.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/src/platform/macos/resident-startup.mjs
MediumShips Build Helperdist/tools/rtc-route-helper.ps1
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/src/platform/windows/rustdesk-video-probe.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @walkhi/code-relax@0.1.0-beta.31.
See all versions of @walkhi/code-relax for other recorded verdicts.
- Review the evidence and your use of @walkhi/code-relax@0.1.0-beta.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.