Loading npm security reports…

capix-code@2.1.0: AI-agent policy block | LPM Firewall

registry / capix-code / 2.1.0

capix-code@2.1.0

Capix Code — decentralized AI coding agent with GPU marketplace

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. An automatic npm postinstall fetches an unauditable external runtime, installs dependencies, and configures OpenCode to load it. This mutates a third-party AI-agent configuration without a separate user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation of capix-code@2.1.0

Impact

Downloaded code can execute through the Capix launcher and be loaded by OpenCode with its agent capabilities.

Mechanism

postinstall remote payload bootstrap plus OpenCode plugin/provider configuration

Policy narrative

On installation, the lifecycle hook downloads a platform archive and its checksum from the same release source, replaces `~/.capix-code`, installs runtime and MCP dependencies, then writes an enabled provider/plugin configuration into OpenCode's configuration directory. The package contents do not contain the downloaded executable/runtime, so its behavior cannot be audited from this tarball; OpenCode is configured to load code from that downloaded runtime.

Rationale

This is an unconsented install-time mutation of a foreign AI-agent control surface, coupled with an external payload bootstrap. Documentation makes the behavior less stealthy but does not remove the install-time control-surface risk. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/postinstall.cjsbin/capix-code.cjsdist/customer/config/defaults.jsonREADME.md

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/capix-code.cjsView file

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

High

Child Process

Package source references child process execution.

bin/capix-code.cjsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = capix-code@2.0.1 matchedPath = bin/capix-code.cjs matchedIdentity = npm:Y2FwaXgtY29kZQ:2.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/capix-code.cjsView on unpkg

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/capix-code.cjsView on unpkg · L2

scripts/postinstall.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = capix-code@1.6.10 matchedIdentity = npm:Y2FwaXgtY29kZQ:1.6.10 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.cjsView on unpkg

1#!/usr/bin/env node L2: const { execSync } = require('child_process'); L3: const fs = require('fs'); ... L6: const crypto = require('crypto'); L7: if (process.env.CI || process.env.GITHUB_ACTIONS) { process.exit(0); } L8: const VERSION = require('../package.json').version; L9: const plat = process.platform === 'win32' ? 'win32' : process.platform; ... L12: const NAME = `capix-code-${VERSION}-${plat}-${arch}-unsigned`; L13: const URL = `https://github.com/CapIX-Protocol/Capix-Code/releases/download/v${VERSION}/${NAME}.${ext}`; L14: const CHECKSUM_URL = `${URL}.sha256`; L15: const ROOT = path.join(os.homedir(), '.capix-code'); L16: const TMP = path.join(os.tmpdir(), `capix-install-${VERSION}`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L1

40console.log('Installing runtime deps...'); L41: execSync('npm install --omit=dev --ignore-scripts', { cwd: path.join(ROOT, 'runtime'), stdio: 'inherit' }); L42: const mcpDir = path.join(ROOT, 'mcp');

High

scripts/assert-customer-brand.shView file

•path = scripts/assert-customer-brand.sh kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/assert-customer-brand.shView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 13-53json

13 "dist/customer/config/",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=20"

19 },

20 "scripts": {

21 "compile": "tsc --noEmit",

22 "lint": "eslint src/",

23 "format": "prettier --write .",

24 "format:check": "prettier --check .",

25 "test": "vitest run",

26 "test:watch": "vitest",

27 "test:coverage": "vitest run --coverage",

28 "manifest:validate": "node scripts/validate-manifest.mjs manifest/release-manifest.json",

29 "manifest:build": "node scripts/build-manifest.mjs",

30 "resolve-version": "node scripts/resolve-version.mjs",

31 "prepack": "node scripts/prepare-npm-meta.mjs",

32 "pack:npm-platform": "node scripts/prepare-npm-platform.mjs",

33 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "devDependencies": {

36 "@ai-sdk/provider": "3.0.8",

37 "@eslint/js": "^9.0.0",

38 "@types/node": "^22.0.0",

39 "@vitest/coverage-v8": "^2.1.0",

40 "eslint": "^9.0.0",

41 "husky": "^9.0.0",

42 "lint-staged": "^15.0.0",

43 "prettier": "^3.0.0",

44 "typescript": "^5.7.0",

45 "typescript-eslint": "^8.0.0",

46 "vitest": "^2.1.0",

47 "@capix/runtime-provider": "file:packages/runtime-provider",

48 "@opencode-ai/plugin": "1.17.18",

49 "@opencode-ai/sdk": "1.17.18",

50 "bun": "^1.3.14",

51 "opencode-ai": "1.17.18"

52 },

53 "lint-staged": {

bin/capix-code.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { spawnSync } = require('node:child_process');

4const { chmodSync, cpSync, existsSync, mkdirSync } = require(

scripts/postinstall.cjsView file

Lines 1-60javascript

1#!/usr/bin/env node

2const { execSync } = require('child_process');

3const fs = require('fs');

4const path

scripts/assert-customer-brand.shView file

•path = scripts/assert-customer-brand.sh kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/assert-customer-brand.shView on unpkg