registry / @xorox-ai/agent / 0.1.6
@xorox-ai/agent@0.1.6
Connects a coding project to [XOROX](https://xorox.eu) — automatic engineering context for Cursor and Claude Code, plus on-demand access to your project's Specifications and Tasks.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package performs automatic install-time setup of its own coding-agent integrations, creating a real agent extension lifecycle risk. The inspected behavior is consistent with package-owned XOROX integration, so warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the npm package triggers its postinstall script.
Impact
The package gains automatic integration with the project’s coding agents. Source inspection did not establish a malicious action or credential theft.
Mechanism
The script writes hook and MCP entries into project configuration files; the Claude prompt hook fetches XOROX context and emits it as additional context.
AI rationale
The package performs automatic install-time setup of its own coding-agent integrations, creating a real agent extension lifecycle risk. The inspected behavior is consistent with package-owned XOROX integration, so warn rather than block.
Evidence
scripts/postinstall.jshooks/claude-prompt-submit.js.cursor/hooks.json.cursor/mcp.json.claude/settings.json.mcp.json
Network endpoints1
api.xorox.eu
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install hook runs scripts/postinstall.js, which automatically installs Cursor and Claude Code hooks and MCP entries.
- The installer writes package-owned integrations into Cursor and Claude project configuration; the Claude prompt hook returns fetched XOROX context as additionalContext.
- The hook sends the XOROX project token to the configured XOROX API, whose default host is api.xorox.eu; the Claude installer retains unrelated hook groups.
Evidence against
- The registered commands point to this package’s own hook and MCP files, and the network request uses the XOROX project API.
- The Claude hook installer preserves unrelated hook groups. These facts support package-owned integration, but do not remove the install-time configuration change.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
46L47: // Claude Code configuration lives at the project root (.claude/settings.json
L48: // for hooks, .mcp.json for MCP servers), a different convention from
L49: // Cursor's .cursor/ directory.
...
L51: projectRoot,
L52: ".claude"
L53: );
...
L61: projectRoot,
L62: ".mcp.json"
L63: );
...
L99: if (!fs.existsSync(cursorDir)) {
L100: fs.mkdirSync(cursorDir, {
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
Findings
1 Critical4 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.js
HighSemantic Analysis Limitedhooks/claude-prompt-submit.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/runtime-manager.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryruntime/xorox-runtime-darwin-x64
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @xorox-ai/agent@0.1.6.
See all versions of @xorox-ai/agent for other recorded verdicts.
- Review the evidence and your use of @xorox-ai/agent@0.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.