registry / @zortexhq/install / 0.1.29

@zortexhq/install@0.1.29

⚠ Under review

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Zortex Windows Codex bootstrap

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The inspected launcher and OAuth helper show package-aligned setup and provider-origin checks, with no confirmed attack behavior. The optional Bun runtime is selected for execution, but its source was unresolved in the review snapshot, preventing a clean verdict.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the zortex command when the optional Bun executable is present.

Impact

The unresolved executable could not be assessed for behavior; the inspected source does not establish an attack.

Mechanism

The launcher starts the Bun executable with the package's runtime bundle and inherits the current process environment.

AI rationale

Evidence

package.jsonbin/zortex.jsdist/zortex.js

Decision evidence

public snapshot

AI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.

AI review observations

The package declares @oven/bun-windows-x64@1.3.14 as an optional dependency, and the launcher resolves its Bun executable.
When invoked, the launcher runs the package CLI through Bun with the caller's environment; the Bun executable's source was not resolved in the review snapshot.

Evidence against

The launcher copies the package's own runtime bundle into a versioned app directory and preserves an existing installation.
The OAuth helper validates startup input, and the Windows helper restricts browser origins to the redirect or the provider's expected host.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 9 file(s), 2.28 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.notion.com, app.example.test, bm.test, developers.notion.com, dl.test, docs.activitywatch.net, docs.github.com, eu.posthog.com, example.test, github.com, gmail.googleapis.com, graph.microsoft.com, idp.fixture.local, login.microsoftonline.com, nodejs.org, oauth2.googleapis.com, posthog.com, us.posthog.com, www.google.com, www.googleapis.com, www.notion.so, zortex-google-oauth.google-oauth-broker.workers.dev

Source & flagged code

8 flagged

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zortex.jsView on unpkg · L3

dist/indrad-main.jsView file

519`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)UY(this.fd,Buffer.alloc(Q),0,Q,p9+this.writeOffset);this.wri... L520: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),MN(this.fd)}}f();class $6{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L521: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L532: `)}async submit($,Z,Q){let X=this.awaitHandshake();this.write({t:"submit",order:$,slice:Z,workerType:Q});let z=await X;if(z.t==="submitted")return this.runId=z.runId,H({runId:z.run... L533: `,"\\n")}function s0($,Z){return`${$} = "${HA(Z)}"`}var gJ=0;function BA($=process.env){let Z=$.ZORTEX_WAN_TRANSPORT?.tr

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/indrad-main.jsView on unpkg · L519

519`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)UY(this.fd,Buffer.alloc(Q),0,Q,p9+this.writeOffset);this.wri... L520: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),MN(this.fd)}}f();class $6{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L521: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L528: terminal_order_failure_reason = ? L529: WHERE run_id = ?`).run(L,Z,J,U,Y??null,$)}else if(W.terminal_payload_json!==J||W.terminal_summary_json!==U||W.terminal_order_failure_reason!==(Y??null))return I("failed_preconditio... L530: `);while(Z>=0){let Q=this.buffer.slice(0,Z).trim();if(this.buffer=this.buffer.sl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/indrad-main.jsView on unpkg · L519

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/indrad-main.jsView on unpkg

dist/zortex.jsView file

2Cross-file remote execution chain: dist/zortex.js spawns dist/indrad-main.js; helper contains network access plus dynamic code execution. L2: // @bun L3: var DR=Object.defineProperty;var FR=($)=>$;function CR($,Z){this[$]=FR.bind(null,Z)}var J8=($,Z)=>{for(var Q in Z)DR($,Q,{get:Z[Q],enumerable:!0,configurable:!0,set:CR.bind(Z,Q)})}... L4: `||X==="\r"){Q++;continue}if(X==='"'){let Y=Q+1,W="";while(Y<$.length&&$.charAt(Y)!=='"'){if($.charAt(Y)==="\\"){let j=$.charAt(Y+1);if(j==='"'||j==="\\"){W+=j,Y+=2;continue}return... L5: PRAGMA journal_mode = MEMORY; ... L20: ORDER BY sort_key, first_line L21: `),new T4($,Z,Q,X)}catch(z){let Y=[];if(X!==null)try{X.finalize()}catch(W){Y.push(W)}if(Q!==null)try{Q.finalize()}catch(W){Y.push(W)}if(Z!==null)try{Z.finalize()}catch(W){Y.push(W)... L22: CREATE

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/zortex.jsView on unpkg · L2

dist/windows-uia-oauth.ps1View file

•path = dist/windows-uia-oauth.ps1 kind = build_helper sizeBytes = 7695 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows-uia-oauth.ps1View on unpkg

dist/microsoft-oauth-browser.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zortexhq/install@0.1.27 matchedIdentity = npm:QHpvcnRleGhxL2luc3RhbGw:0.1.27 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/microsoft-oauth-browser.cjsView on unpkg

Source & flagged code

8 flagged · loading source

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zortex.jsView on unpkg · L3

dist/indrad-main.jsView file

Findings

1 Critical5 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/microsoft-oauth-browser.cjs

HighChild Processbin/zortex.js

HighSame File Env Network Executiondist/indrad-main.js

HighCommand Output Exfiltrationdist/indrad-main.js

HighCross File Remote Execution Contextdist/zortex.js

HighSemantic Analysis Limiteddist/indrad-main.js

MediumDynamic Requirebin/zortex.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/windows-uia-oauth.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @zortexhq/install@0.1.29.

See all versions of @zortexhq/install for other recorded verdicts.

Review the evidence and your use of @zortexhq/install@0.1.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 01:51:11.570Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.