registry / @walkhi/code-relax / 0.1.0-beta.68

@walkhi/code-relax@0.1.0-beta.68

Code Relax Windows, macOS and Linux workstation service

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The automatic global-install setup changes agent behavior and service startup, supporting a warning for first-party agent extension lifecycle risk. The inspected behavior does not establish a concrete attack warranting a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Direct postinstall execution during a global npm install.

Impact

The package adds agent-readable guidance and configures its service to start at login.

Mechanism

The hook runs setup and a health check; setup enables resident startup and installs the package’s skill under the user’s agent skills directory.

AI rationale

Evidence

package.jsontools/postinstall.mjsdist/bin/codex-remote.mjsdist/src/skill-install.mjsdist/src/dots-room-client.mjsdist/src/dots-chat-server.mjs~/.agents/skills/code-relax/SKILL.md~/.agents/skills/code-relax/.code-relax-install.json

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs a postinstall script; the hook proceeds only when invoked directly during a global npm install, then runs setup and a health check.
Setup enables service startup at login and installs the package-provided skill into the user’s agent skills directory.
The installer writes only to the package-owned skill directory and refuses to replace an unmanaged or modified skill.
The flagged room-client code parses server-sent event data; review found no callback caller in the inspected client uses.

Evidence against

The inspected setup installs a package-owned skill and does not establish a broad agent configuration change or credential transfer.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

19 flagged

package.jsonView file

Lines 1-28json

2 "name": "@walkhi/code-relax",

3 "version": "0.1.0-beta.68",

4 "private": false,

5 "license": "UNLICENSED",

6 "type": "module",

7 "scripts": {

8 "postinstall": "node ./tools/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

10 "dependencies": {

11 "mysql2": "^3.24.4",

12 "node-datachannel": "0.33.4",

13 "qrcode": "1.5.4",

14 "sharp": "0.35.5",

15 "ws": "8.21.3"

16 },

17 "bin": {

18 "relax": "dist/bin/codex-remote.mjs",

19 "code-relax": "dist/bin/codex-remote.mjs"

20 },

21 "description": "Code Relax Windows, macOS and Linux workstation service",

22 "engines": {

23 "node": ">=22.12.0"

24 },

25 "os": [

26 "win32",

27 "darwin",

28 "linux"

dist/src/platform/windows/rustdesk-video-probe.mjsView file

Lines 57-97javascript

57}

59// A read-only, LAN-only prototype. The normal desktop helper and input path are independent.

60export class RustDeskVideoProbe {

61 constructor({ stateRoot, appData = process.env.APPDATA, platform

tools/postinstall.mjsView file

Lines 1-28javascript

1import { execFileSync } from 'node:child_process';

2import fs from 'node:fs';

High

Child Process

Package source references child process execution.

tools/postinstall.mjsView on unpkg · L1

3import os from 'node:os';

4import

dist/src/server.mjsView file

Lines 1-23javascript

1import crypto from 'node:crypto';

2import { RustDeskVideoProbe } from './platform/windows/rustdesk-video-probe.mjs';

3import fs from 'node:fs';

4import http from 'node:http';

dist/bin/release-upload-server.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from 'node:fs';

3import os from 'node:os';

4import path from 'node:path';

5import http from

dist/src/platform/macos/resident-startup.mjsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import { execFile } from 'node:child_process'

dist/src/platform/windows/desktop-helper.mjsView file

1import net from 'node:net'; L2: import fs from 'node:fs'; L3: import path from 'node:path'; L4: import { execFile } from 'node:child_process'; L5: import { promisify } from 'node:util'; ... L10: const binary = fileURLToPath(new URL('../../../native/desktop-helper/CodeRelaxDesktop.exe', import.meta.url)); L11: const powershell = path.join(process.env.SystemRoot || 'C:/Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe'); L12: const quote = value => `'${String(value).replaceAll("'", "''")}'`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/platform/windows/desktop-helper.mjsView on unpkg · L1

dist/bin/codex-remote.mjsView file

26Install-time code directly mutates a foreign AI-agent control surface: L122: } else { L123: if (options.length) { fs.mkdirSync(stateRoot, { recursive: true }); writeRecord(powerConfigPath(stateRoot), { enabled: options[0] === 'on' }); } L124: result = { enabled: powerEnabled(stateRoot), active: false, error: '', serviceStopped: true }; ... L264: const source = path.join(stateRoot, name), target = path.join(physicalStateRoot, name); L265: if (fs.existsSync(source) && !fs.existsSync(target)) fs.copyFileSync(source, target, fs.constants.COPYFILE_EXCL); L266: } ... L378: installed.managedAppServer = bridge.managedAppServer; L379: installed.codexRuntime = runtime; L380: installed.managedAppServerMigrated = managedAppServerMigrated; Write operation from tools/postinstall.mjs: L26: function appen

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/bin/codex-remote.mjsView on unpkg · L26

•matchType = previous_version_dangerous_delta matchedPackage = @walkhi/code-relax@0.1.0-beta.66 matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.66 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/codex-remote.mjsView on unpkg

dist/src/skill-install.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import os from 'node:os'; import { createhash } from 'node:crypto'; import { readrecord, writerecord } from './service-lifecycle.mjs'; const owner = '@walkhi/code-relax'; const markername = '.code-relax-install.json'; const digest = value => createhash('sha256').update(value).digest('hex'); export const sk[redacted] = (home = os.homedir()) => path.join(home, '.agents/skills/code-relax'); export function assertplainpath(target) { for (let item = path.resolve(target); ; item = path.dirname(item)) { try { if (fs.lstatsync(i

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skill-install.mjsView on unpkg

dist/tools/rtc-route-helper.ps1View file

•path = dist/tools/rtc-route-helper.ps1 kind = build_helper sizeBytes = 5267 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/tools/rtc-route-helper.ps1View on unpkg

dist/shared/code-browser.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/shared/code-browser.cjs#virtual:normalized:round1View on unpkg

dist/src/background-process.mjsView file

•matchType = normalized_sha256 matchedPackage = @walkhi/code-relax@0.1.0-beta.1 matchedPath = dist/src/background-process.mjs matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/background-process.mjsView on unpkg

dist/src/platform/windows/network-info.mjsView file

•matchType = normalized_sha256 matchedPackage = @walkhi/code-relax@0.1.0-beta.1 matchedPath = [redacted]-info.mjs matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/platform/windows/network-info.mjsView on unpkg

dist/src/self-relay/windows-route-helper.mjsView file

•matchType = normalized_sha256 matchedPackage = @walkhi/code-relax@0.1.0-beta.1 matchedPath = dist/src/self-relay/windows-route-helper.mjs matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/self-relay/windows-route-helper.mjsView on unpkg

dist/web/vendor/markdown-it.umd.min.jsView file

•matchType = normalized_sha256 matchedPackage = @walkhi/code-relax@0.1.0-beta.1 matchedPath = dist/web/vendor/markdown-it.umd.min.js matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/vendor/markdown-it.umd.min.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./tools/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./tools/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/platform/windows/rustdesk-video-probe.mjsView file

77patternName = generic_password severity = medium line = 77

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/platform/windows/rustdesk-video-probe.mjsView on unpkg · L77

Findings

2 Critical10 High9 Medium7 Low

CriticalAi Agent Control Hijackdist/bin/codex-remote.mjs

CriticalPrevious Version Dangerous Deltadist/bin/codex-remote.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processtools/postinstall.mjs

HighSame File Env Network Executiondist/src/platform/windows/desktop-helper.mjs

HighObfuscated Payload Loaderdist/src/server.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/skill-install.mjs

HighSemantic Analysis Limiteddist/shared/code-browser.cjs#virtual:normalized:round1

HighKnown Malware Source Similaritydist/src/background-process.mjs

HighKnown Malware Source Similaritydist/src/platform/windows/network-info.mjs

Affected versions and remediation

This report applies to @walkhi/code-relax@0.1.0-beta.68.

See all versions of @walkhi/code-relax for other recorded verdicts.

Review the evidence and your use of @walkhi/code-relax@0.1.0-beta.68 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 06:23:29.473Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.