registry / @zortexhq/install / 0.1.35

@zortexhq/install@0.1.35

⚠ Under review

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Zortex Windows Codex bootstrap

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 8 file(s), 2.27 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.notion.com, app.example.test, bm.test, developers.notion.com, dl.test, docs.activitywatch.net, docs.github.com, eu.posthog.com, example.test, github.com, gmail.googleapis.com, graph.microsoft.com, idp.fixture.local, login.microsoftonline.com, nodejs.org, oauth2.googleapis.com, posthog.com, us.posthog.com, www.google.com, www.googleapis.com, www.notion.so, zortex-google-oauth.google-oauth-broker.workers.dev

Source & flagged code

6 flagged

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

3Cross-file remote execution chain: bin/zortex.js spawns dist/zortex.js; helper contains network access plus dynamic code execution. L3: L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs"); ... L8: L9: const ROOT = join(__dirname, ".."); L10: const PACKAGE_NAME = "@zortexhq/install"; ... L12: function packageVersion(packageRoot = ROOT) { L13: const version = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")).version; L14: if (typeof version !== "string" || !/^[0-9A-Za-z.-]+$/.test(version)) throw new Error("package version is invalid"); ... L17: L18: function runtimeEnv(packageRoot = ROOT, env = process.env) { L19: return { ...env, ZORTEX_R

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zortex.jsView on unpkg · L3

dist/indrad-main.jsView file

518`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)XY(this.fd,Buffer.alloc(Q),0,Q,f9+this.writeOffset);this.wri... L519: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),oC(this.fd)}}w();class l1{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L520: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L531: `)}async submit($,Z,Q){let X=this.awaitHandshake();this.write({t:"submit",order:$,slice:Z,workerType:Q});let z=await X;if(z.t==="submitted")return this.runId=z.runId,H({runId:z.run... L532: `,"\\n")}function i0($,Z){return`${$} = "${pN(Z)}"`}var TJ=0;function lN($=process.env){let Z=$.ZORTEX_WAN_TRANSPORT?.tr

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/indrad-main.jsView on unpkg · L518

518`,"utf8");if(Z.length>=this.size)return;if(this.writeOffset+Z.length>this.size){let Q=this.size-this.writeOffset;if(Q>0)XY(this.fd,Buffer.alloc(Q),0,Q,f9+this.writeOffset);this.wri... L519: `);return(X>=0?Q.slice(X+1):"")+Z}close(){this.flushHeader(),oC(this.fd)}}w();class l1{talon;constructor($){this.talon=$}requestRecall($,Z){if($.by==="watchdog"&&Z.kind!=="kernel")... L520: budget_tokens, budget_usd, budget_wallclock_min, respawn_of, reap_count, model_pin, trace_id, ... L527: terminal_order_failure_reason = ? L528: WHERE run_id = ?`).run(L,Z,J,U,Y??null,$)}else if(W.terminal_payload_json!==J||W.terminal_summary_json!==U||W.terminal_order_failure_reason!==(Y??null))return x("failed_preconditio... L529: `);while(Z>=0){let Q=this.buffer.slice(0,Z).trim();if(this.buffer=this.buffer.sl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/indrad-main.js

dist/windows-uia-oauth.ps1View file

•path = dist/windows-uia-oauth.ps1 kind = build_helper sizeBytes = 21083 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows-uia-oauth.ps1View on unpkg

Source & flagged code

6 flagged · loading source

bin/zortex.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/zortex.jsView on unpkg · L3

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/zortex.jsView on unpkg · L3

3L4: const { spawnSync } = require("node:child_process"); L5: const { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, statSync } = require("node:fs");

Findings

4 High5 Medium5 Low

HighChild Processbin/zortex.js

HighSame File Env Network Executiondist/indrad-main.js

HighCommand Output Exfiltrationdist/indrad-main.js

HighCross File Remote Execution Contextbin/zortex.js

MediumDynamic Requirebin/zortex.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/windows-uia-oauth.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @zortexhq/install@0.1.35.

See all versions of @zortexhq/install for other recorded verdicts.

Review the evidence and your use of @zortexhq/install@0.1.35 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 12:25:53.832Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.