registry / @zortexhq/install / 0.1.26

@zortexhq/install@0.1.26

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Zortex Windows Codex bootstrap

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 9 file(s), 2.28 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.notion.com, app.example.test, bm.test, developers.notion.com, dl.test, docs.activitywatch.net, docs.github.com, eu.posthog.com, example.test, github.com, gmail.googleapis.com, graph.microsoft.com, idp.fixture.local, login.microsoftonline.com, nodejs.org, oauth2.googleapis.com, posthog.com, us.posthog.com, www.google.com, www.googleapis.com, www.notion.so, zortex-google-oauth.google-oauth-broker.workers.dev

Source & flagged code

6 flagged

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, existsSync, mkdirSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, existsSync, mkdirSync, statSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zortex.jsView on unpkg · L3

dist/indrad-main.jsView file

515`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)MY(this.fd,Buffer.alloc(Q),0,Q,p9+this.writeOffset);this.wri... L516: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),CN(this.fd)}}f();class e1{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L517: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L528: `)}async submit($,Z,Q){let X=this.awaitHandshake();this.write({t:"submit",order:$,slice:Z,workerType:Q});let z=await X;if(z.t==="submitted")return this.runId=z.runId,H({runId:z.run... L529: `,"\\n")}function s0($,Z){return`${$} = "${JA(Z)}"`}var gJ=0;function GA($=process.env){let Z=$.ZORTEX_WAN_TRANSPORT?.tr

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/indrad-main.jsView on unpkg · L515

515`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)MY(this.fd,Buffer.alloc(Q),0,Q,p9+this.writeOffset);this.wri... L516: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),CN(this.fd)}}f();class e1{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L517: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L524: terminal_order_failure_reason = ? L525: WHERE run_id = ?`).run(L,Z,J,U,Y??null,$)}else if(W.terminal_payload_json!==J||W.terminal_summary_json!==U||W.terminal_order_failure_reason!==(Y??null))return I("failed_preconditio... L526: `);while(Z>=0){let Q=this.buffer.slice(0,Z).trim();if(this.buffer=this.buffer.sl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/indrad-main.jsView on unpkg · L515

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/indrad-main.jsView on unpkg

dist/zortex.jsView file

2Cross-file remote execution chain: dist/zortex.js spawns dist/indrad-main.js; helper contains network access plus dynamic code execution. L2: // @bun L3: var JR=Object.defineProperty;var KR=($)=>$;function BR($,Z){this[$]=KR.bind(null,Z)}var V8=($,Z)=>{for(var Q in Z)JR($,Q,{get:Z[Q],enumerable:!0,configurable:!0,set:BR.bind(Z,Q)})}... L4: `||X==="\r"){Q++;continue}if(X==='"'){let Y=Q+1,W="";while(Y<$.length&&$.charAt(Y)!=='"'){if($.charAt(Y)==="\\"){let j=$.charAt(Y+1);if(j==='"'||j==="\\"){W+=j,Y+=2;continue}return... L5: PRAGMA journal_mode = MEMORY; ... L20: ORDER BY sort_key, first_line L21: `),new A4($,Z,Q,X)}catch(z){let Y=[];if(X!==null)try{X.finalize()}catch(W){Y.push(W)}if(Q!==null)try{Q.finalize()}catch(W){Y.push(W)}if(Z!==null)try{Z.finalize()}catch(W){Y.push(W)... L22: CREATE

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/zortex.jsView on unpkg · L2

Source & flagged code

6 flagged · loading source

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, existsSync, mkdirSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, existsSync, mkdirSync, statSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zortex.jsView on unpkg · L3

dist/indrad-main.jsView file

Findings

5 High4 Medium5 Low

HighChild Processbin/zortex.js

HighSame File Env Network Executiondist/indrad-main.js

HighCommand Output Exfiltrationdist/indrad-main.js

HighCross File Remote Execution Contextdist/zortex.js

HighSemantic Analysis Limiteddist/indrad-main.js

MediumDynamic Requirebin/zortex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @zortexhq/install@0.1.26.

See all versions of @zortexhq/install for other recorded verdicts.

Review the evidence and your use of @zortexhq/install@0.1.26 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 15:03:38.299Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.