registry / @zortexhq/install / 0.1.31

@zortexhq/install@0.1.31

⚠ Under review

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Zortex Windows Codex bootstrap

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 8 file(s), 2.26 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.notion.com, app.example.test, bm.test, developers.notion.com, dl.test, docs.activitywatch.net, docs.github.com, eu.posthog.com, example.test, github.com, gmail.googleapis.com, graph.microsoft.com, idp.fixture.local, login.microsoftonline.com, nodejs.org, oauth2.googleapis.com, posthog.com, us.posthog.com, www.google.com, www.googleapis.com, www.notion.so, zortex-google-oauth.google-oauth-broker.workers.dev

Source & flagged code

6 flagged

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zortex.jsView on unpkg · L3

dist/indrad-main.jsView file

518`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)XY(this.fd,Buffer.alloc(Q),0,Q,f9+this.writeOffset);this.wri... L519: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),oC(this.fd)}}w();class l1{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L520: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L531: `)}async submit($,Z,Q){let X=this.awaitHandshake();this.write({t:"submit",order:$,slice:Z,workerType:Q});let z=await X;if(z.t==="submitted")return this.runId=z.runId,H({runId:z.run... L532: `,"\\n")}function i0($,Z){return`${$} = "${pN(Z)}"`}var TJ=0;function lN($=process.env){let Z=$.ZORTEX_WAN_TRANSPORT?.tr

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/indrad-main.jsView on unpkg · L518

518`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)XY(this.fd,Buffer.alloc(Q),0,Q,f9+this.writeOffset);this.wri... L519: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),oC(this.fd)}}w();class l1{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L520: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L527: terminal_order_failure_reason = ? L528: WHERE run_id = ?`).run(L,Z,J,U,Y??null,$)}else if(W.terminal_payload_json!==J||W.terminal_summary_json!==U||W.terminal_order_failure_reason!==(Y??null))return x("failed_preconditio... L529: `);while(Z>=0){let Q=this.buffer.slice(0,Z).trim();if(this.buffer=this.buffer.sl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/indrad-main.jsView on unpkg · L518

dist/zortex.jsView file

2Cross-file remote execution chain: dist/zortex.js spawns dist/indrad-main.js; helper contains network access plus dynamic code execution. L2: // @bun L3: var e_=Object.defineProperty;var $R=($)=>$;function ZR($,Z){this[$]=$R.bind(null,Z)}var G8=($,Z)=>{for(var Q in Z)e_($,Q,{get:Z[Q],enumerable:!0,configurable:!0,set:ZR.bind(Z,Q)})}... L4: `||X==="\r"){Q++;continue}if(X==='"'){let Y=Q+1,W="";while(Y<$.length&&$.charAt(Y)!=='"'){if($.charAt(Y)==="\\"){let j=$.charAt(Y+1);if(j==='"'||j==="\\"){W+=j,Y+=2;continue}return... L5: PRAGMA journal_mode = MEMORY; ... L20: ORDER BY sort_key, first_line L21: `),new U4($,Z,Q,X)}catch(z){let Y=[];if(X!==null)try{X.finalize()}catch(W){Y.push(W)}if(Q!==null)try{Q.finalize()}catch(W){Y.push(W)}if(Z!==null)try{Z.finalize()}catch(W){Y.push(W)... L22: CREATE

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/zortex.jsView on unpkg · L2

dist/windows-uia-oauth.ps1View file

•path = dist/windows-uia-oauth.ps1 kind = build_helper sizeBytes = 19547 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows-uia-oauth.ps1View on unpkg

Source & flagged code

6 flagged · loading source

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zortex.jsView on unpkg · L3

dist/indrad-main.jsView file

Findings

4 High5 Medium5 Low

HighChild Processbin/zortex.js

HighSame File Env Network Executiondist/indrad-main.js

HighCommand Output Exfiltrationdist/indrad-main.js

HighCross File Remote Execution Contextdist/zortex.js

MediumDynamic Requirebin/zortex.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/windows-uia-oauth.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @zortexhq/install@0.1.31.

See all versions of @zortexhq/install for other recorded verdicts.

Review the evidence and your use of @zortexhq/install@0.1.31 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 10:22:32.201Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.