Loading npm security reports…

capix-code@2.2.0: AI-agent policy block | LPM Firewall

registry / capix-code / 2.2.0

capix-code@2.2.0

Capix Code — decentralized AI coding agent with GPU marketplace

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. `npm install` downloads and persists a remote native/runtime payload in `~/.capix-code`. It also installs an additional npm package and configures OpenCode to load Capix plugins/providers without a user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall, except when CI or GITHUB_ACTIONS is set

Impact

A package installation can add executable runtime components and alter an AI-agent control surface to load package-controlled code.

Mechanism

install-time remote payload installation and OpenCode plugin/provider configuration

Policy narrative

On npm installation, the lifecycle hook downloads an unsigned release archive, verifies it only against a checksum fetched from the same release location, extracts it into the user home directory, and installs further runtime dependencies. It then writes an OpenCode configuration that registers package-controlled plugin paths and a Capix provider. This is an unconsented install-time mutation of a foreign AI-agent configuration surface and enables later loading of remotely delivered code.

Rationale

Direct source inspection confirms a concrete postinstall chain that persists remote code and writes OpenCode plugin/provider configuration. The same-origin checksum does not establish independent artifact trust.

Evidence

package.jsonscripts/postinstall.cjsbin/capix-code.cjsREADME.md~/.capix-code~/.capix-code/runtime

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/capix-code.cjsView file

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

High

Child Process

Package source references child process execution.

bin/capix-code.cjsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = capix-code@2.1.2 matchedPath = bin/capix-code.cjs matchedIdentity = npm:Y2FwaXgtY29kZQ:2.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/capix-code.cjsView on unpkg

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/capix-code.cjsView on unpkg · L2

scripts/postinstall.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = capix-code@1.6.10 matchedIdentity = npm:Y2FwaXgtY29kZQ:1.6.10 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.cjsView on unpkg

1#!/usr/bin/env node L2: const { execSync } = require('child_process'); L3: const fs = require('fs'); ... L6: const crypto = require('crypto'); L7: if (process.env.CI || process.env.GITHUB_ACTIONS) { process.exit(0); } L8: const VERSION = require('../package.json').version; L9: const plat = process.platform === 'win32' ? 'win32' : process.platform; ... L12: const NAME = `capix-code-${VERSION}-${plat}-${arch}-unsigned`; L13: const URL = `https://github.com/CapIX-Protocol/Capix-Code/releases/download/v${VERSION}/${NAME}.${ext}`; L14: const CHECKSUM_URL = `${URL}.sha256`; L15: const ROOT = path.join(os.homedir(), '.capix-code'); L16: const TMP = path.join(os.tmpdir(), `capix-install-${VERSION}`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L1

40console.log('Installing runtime deps...'); L41: execSync('npm install --omit=dev --ignore-scripts', { cwd: path.join(ROOT, 'runtime'), stdio: 'inherit' }); L42: const mcpDir = path.join(ROOT, 'mcp');

High

scripts/assert-customer-brand.shView file

•path = scripts/assert-customer-brand.sh kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/assert-customer-brand.shView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 13-53json

13 "dist/customer/config/",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=20"

19 },

20 "scripts": {

21 "compile": "tsc --noEmit",

22 "lint": "eslint src/",

23 "format": "prettier --write .",

24 "format:check": "prettier --check .",

25 "test": "vitest run",

26 "test:watch": "vitest",

27 "test:coverage": "vitest run --coverage",

28 "manifest:validate": "node scripts/validate-manifest.mjs manifest/release-manifest.json",

29 "manifest:build": "node scripts/build-manifest.mjs",

30 "resolve-version": "node scripts/resolve-version.mjs",

31 "prepack": "node scripts/prepare-npm-meta.mjs",

32 "pack:npm-platform": "node scripts/prepare-npm-platform.mjs",

33 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "devDependencies": {

36 "@ai-sdk/provider": "3.0.8",

37 "@capix/runtime-provider": "file:packages/runtime-provider",

38 "@commitlint/config-conventional": "^21.2.0",

39 "@eslint/js": "^9.0.0",

40 "@opencode-ai/plugin": "1.17.18",

41 "@opencode-ai/sdk": "1.17.18",

42 "@types/node": "^22.0.0",

43 "@vitest/coverage-v8": "^2.1.0",

44 "bun": "^1.3.14",

45 "commitlint": "^21.2.1",

46 "eslint": "^9.0.0",

47 "husky": "^9.0.0",

48 "lint-staged": "^15.0.0",

49 "opencode-ai": "1.17.18",

50 "prettier": "^3.0.0",

51 "typescript": "^5.7.0",

52 "typescript-eslint": "^8.0.0",

53 "vitest": "^2.1.0"

bin/capix-code.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { spawnSync } = require('node:child_process');

4const { chmodSync, cpSync, existsSync, mkdirSync } = require(

scripts/postinstall.cjsView file

Lines 1-60javascript

1#!/usr/bin/env node

2const { execSync } = require('child_process');

3const fs = require('fs');

4const path

scripts/assert-customer-brand.shView file

•path = scripts/assert-customer-brand.sh kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/assert-customer-brand.shView on unpkg