registry / AI-agent control-surface risk / capix-code

capix-code

Capix Code — decentralized AI coding agent with GPU marketplace

This report shows the evidence for capix-code@2.2.4. 8 of 24 known versions are blocked or flagged. The newest version, 2.4.9, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package concretely performs unconsented postinstall mutation of OpenCode configuration and activates plugin paths supplied by a remotely downloaded artifact. This meets the firewall block boundary regardless of the checksum check, which does not make the payload source inspectable or user-consented.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Automatic `postinstall` during npm installation.

Impact

A package install can persist package-controlled code into an AI-agent configuration that may be loaded by OpenCode.

Mechanism

downloads remote runtime, installs dependencies, and writes OpenCode provider/plugin configuration

Policy narrative

Installing the package automatically runs `scripts/postinstall.cjs`, which downloads an archive from a release URL, extracts it to `~/.capix-code`, installs additional runtime and MCP dependencies, and writes `~/.config/opencode/capix-code.json`. That configuration registers package-controlled plugin paths from the downloaded runtime and makes Capix the enabled provider. The package archive does not contain the runtime/plugin source that the postinstall configuration enables, so the install-time lifecycle hook creates an unconsented foreign AI-agent control-surface mutation.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsbin/capix-code.cjsdist/customer/config/defaults.json~/.capix-code~/.capix-code/runtime~/.capix-code/mcp~/.config/opencode/capix-code.json

Network endpoints2

github.com/CapIX-Protocol/Capix-Code/releases/download/v${VERSION}/${NAME}.${ext}

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

`package.json` runs `scripts/postinstall.cjs` automatically on install.
`scripts/postinstall.cjs` downloads and extracts a remote executable/runtime into `~/.capix-code`.
Postinstall writes `~/.config/opencode/capix-code.json` with local plugin paths and a Capix provider.
The written OpenCode configuration points to runtime code fetched during installation, not source packaged for inspection.
Postinstall performs a second runtime dependency install for `capix-mcp@2.1.0`.

Evidence against

The archive is SHA-256 checked before extraction.
No credential harvesting or direct data-exfiltration code is present in inspected npm-package source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/capix-code.cjsView file

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

High

Child Process

Package source references child process execution.

bin/capix-code.cjsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = capix-code@2.2.2 matchedPath = bin/capix-code.cjs matchedIdentity = npm:Y2FwaXgtY29kZQ:2.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/capix-code.cjsView on unpkg

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/capix-code.cjsView on unpkg · L2

scripts/postinstall.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = capix-code@1.6.10 matchedIdentity = npm:Y2FwaXgtY29kZQ:1.6.10 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.cjsView on unpkg

1#!/usr/bin/env node L2: const { execSync } = require('child_process'); L3: const fs = require('fs'); ... L6: const crypto = require('crypto'); L7: if (process.env.CI || process.env.GITHUB_ACTIONS) { process.exit(0); } L8: const VERSION = require('../package.json').version; L9: const plat = process.platform === 'win32' ? 'win32' : process.platform; ... L12: const NAME = `capix-code-${VERSION}-${plat}-${arch}-unsigned`; L13: const URL = `https://github.com/CapIX-Protocol/Capix-Code/releases/download/v${VERSION}/${NAME}.${ext}`; L14: const CHECKSUM_URL = `${URL}.sha256`; L15: const ROOT = path.join(os.homedir(), '.capix-code'); L16: const TMP = path.join(os.tmpdir(), `capix-install-${VERSION}`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L1

40console.log('Installing runtime deps...'); L41: execSync('npm install --omit=dev --ignore-scripts', { cwd: path.join(ROOT, 'runtime'), stdio: 'inherit' }); L42: const mcpDir = path.join(ROOT, 'mcp');

High

scripts/assert-customer-brand.shView file

•path = scripts/assert-customer-brand.sh kind = build_helper sizeBytes = 2059 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/assert-customer-brand.shView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/capix-code.cjsView file

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

High

Child Process

Package source references child process execution.

bin/capix-code.cjsView on unpkg · L2

Findings

1 Critical8 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltascripts/postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/capix-code.cjs

HighShell

HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs

HighRuntime Package Installscripts/postinstall.cjs

HighKnown Malware Source Similarityscripts/postinstall.cjs

HighKnown Malware Source Similaritybin/capix-code.cjs

HighKnown Malware Source Fingerprint Signaturescripts/postinstall.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/capix-code.cjs

MediumNetwork

Affected versions and remediation

This report applies to capix-code@2.2.4.

The versions list below shows the verdict for each recorded version.

Avoid installing capix-code@2.2.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-18 10:19:59.856Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

24 known versions

2.4.9latestSuspiciousAgent extension lifecycle riskWarnPublishedJul 22, 2026, 10:41 PM 2.3.0Suspicious—WarnPublishedJul 19, 2026, 3:57 PM 2.2.5Suspicious—WarnPublishedJul 18, 2026, 10:47 PM 2.2.4shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 18, 2026, 10:14 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code