base_parts_ai@1.0.59
jaskle base_parts_ai
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no automatic npm lifecycle hook, but its explicit Codex setup command writes remotely fetched text to the global `AGENTS.md` instruction file. That leaves a concrete agent-configuration risk without source evidence of malicious content, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs `jcx setapi` or invokes `jcx` without a subcommand.
Impact
The fetched text may change instructions used by Codex in later sessions.
Mechanism
After writing Codex configuration, the workflow fetches text from `jai.jaskle.cn` and writes the response directly to `~/.codex/AGENTS.md`.
AI rationale
The package has no automatic npm lifecycle hook, but its explicit Codex setup command writes remotely fetched text to the global `AGENTS.md` instruction file. That leaves a concrete agent-configuration risk without source evidence of malicious content, so a warning is appropriate.
Evidence
bin/jcx.jslib/setapi_cx.jslib/ai_utils.js~/.codex/AGENTS.md
Network endpoints1
jai.jaskle.cn/hm/pub/ai_tip?cli=cx
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines a nonstandard `__postinstall` script, not an automatic npm lifecycle hook.
- The `jcx setapi` command invokes the Codex configuration workflow when run by the user.
- That workflow fetches remote text and writes it to the configured `AGENTS.md` path, which is `~/.codex/AGENTS.md`.
- The remote text is fetched from the package’s configured `jai.jaskle.cn` endpoint.
- The `ucx.js` target only checks whether a directory is named `.codex` or begins with `.codex_`; it does not mutate agent instructions.
- The package also configures Claude’s `settings.json` path under the user’s `.claude` directory.
Evidence against
- The remote `AGENTS.md` write is reached through an explicit configuration command, not an install hook.
- The source inspected does not establish that the fetched content is malicious or that credentials are sent to the endpoint.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flagged · loading sourcebin/jcx.jsView file
7var path = require('path');
L8: var { execSync } = require('child_process');
L9: var { Command } = require('commander');
High
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
'use strict';
var fs = require('fs');
var os = require('os');
var path = require('path');
var { execsync } = require('child_process');
var { command } = require('commander');
function getbuildcfg(cmd) {
var buildcfg = {};
buildcfg.details = cmd.details;
try {
var npmrootg = execsync('npm root -g', { encoding: 'utf8' }).trim();
var codexpkgpath = path.jo
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/jcx.jsView on unpkgbin/jgrok.jsView file
Findings
1 Critical6 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltalib/ucx.js
HighChild Processbin/jcx.js
HighShell
HighSandbox Evasion Gated Capabilitylib/ai_utils.js
HighExternal Ai Agent Control Surface Mutationbin/jcx.js
HighRuntime Package Installlib/ai_utils.js
HighSemantic Analysis Limitedlib/ucx.js#virtual:normalized:round1
MediumDynamic Requirebin/jgrok.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to base_parts_ai@1.0.59.
See all versions of base_parts_ai for other recorded verdicts.
- Review the evidence and your use of base_parts_ai@1.0.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.