Loading npm security reports…

codex-goat@0.1.7: AI-agent control-surface risk | LPM Firewall

registry / codex-goat / 0.1.7

codex-goat@0.1.7

A stronger default for OpenAI Codex CLI: better prompts, one consistent workflow, and runtime helpers. Codex stays the execution engine.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically modifies the user's Codex control surface and registers package commands as hooks. It also retrieves and executes a release binary and makes unsafe Codex permissions the wrapper default.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during a global installation; later Codex hook events or a goat launch.

Impact

Package code can influence future Codex sessions and run with approvals disabled and unrestricted sandboxing.

Mechanism

Automatic global agent configuration, hook registration, binary retrieval, and unsafe permission injection.

Policy narrative

On global installation, the postinstall script calls user-scope setup. That setup copies skills, appends guidance to the global Codex instructions file, and registers package commands for SessionStart, UserPromptSubmit, and Stop hooks. The lifecycle path also downloads a native executable from the package release and installs it locally. When the user subsequently launches the wrapper, it supplies settings that disable approvals and use a danger-full-access sandbox unless the user explicitly opts out.

AI rationale

This is an unconsented postinstall mutation of a broad, foreign AI-agent control surface, combined with downloaded executable code and unsafe default permissions. The behavior is concrete and lifecycle-reachable, so it meets the publish-block boundary.

Evidence

package.jsonscripts/postinstall.mjsdist/cli/commands/setup.jsdist/setup/hooks-file.jsdist/setup/native-runtime.jsdist/cli/launch.js

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks/goat-hook.mjsView file

62try { L63: const handler = await import(new URL("../dist/hooks/handler.js", import.meta.url).href); L64: process.stdout.write(handler.runHookFromStdin(raw));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hooks/goat-hook.mjsView on unpkg · L62

dist/cli/commands/setup.jsView file

1import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs"; L2: import { homedir } from "node:os"; ... L14: skillsRoot: userSkillsRoot(), L15: agentsFile: join(codexHome(), "AGENTS.md"), L16: hooksFile: join(codexHome(), "hooks.json"), ... L23: skillsRoot: projectSkillsRoot(root), L24: agentsFile: join(root, "AGENTS.md"), L25: hooksFile: join(root, ".codex", "hooks.json"), L26: goatRoot: goatPaths(cwd).root, ... L55: log.detail(`skills -> ${targets.skillsRoot}`); L56: log.detail(`AGENTS -> ${targets.agentsFile}`); L57: log.detail(`hooks -> ${targets.hooksFile}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/commands/setup.jsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, rmsync, statsync } from "node:fs"; import { homedir } from "node:os"; import { join } from "node:path"; import { ensuredir, readjson, writefileatomic, writejsonatomic } from "../../core/fsx.js"; import { goaterror, log } from "../../core/log.js"; import { bundleddir, codexhome, findprojectroot, goatpaths, packageroot, projectskillsroot, userskillsroot, } from "../../core/paths.js"; import { hasagentssection, mergeagentssection } from "../../setup/agents-md.js"; import { installhooks, unsupportedtoplevelkeys } from "../../setup/hooks-file.js"; import { flagbool, flagstring } from "../args.js"; export function reso

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/setup.jsView on unpkg

dist/cli/launch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/launch.js#virtual:normalized:round1View on unpkg

dist/setup/native-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codex-goat@0.1.5 matchedIdentity = npm:Y29kZXgtZ29hdA:0.1.5 similarity = 0.514 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/setup/native-runtime.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 9-49json

9 "codex-goat": "dist/cli/goat.js"

10 },

11 "engines": {

12 "node": ">=20"

13 },

14 "scripts": {

15 "build": "node scripts/clean.mjs && tsc && node scripts/chmod-bin.mjs",

16 "build:native": "cargo build --release -p goat-runtime",

17 "build:bun": "bun build src/cli/goat.ts --compile --minify --outfile bin/goat",

18 "dev": "tsc --watch",

19 "lint": "biome lint src",

20 "format": "biome format --write src",

21 "test": "npm run build && npm run test:unit && npm run test:contract",

22 "test:unit": "node scripts/run-tests.mjs",

23 "test:contract": "node scripts/verify-bundle.mjs",

24 "test:native": "cargo test -p goat-runtime",

25 "verify": "npm run lint && npm run test && npm run test:native",

26 "setup": "node dist/cli/goat.js setup",

27 "doctor": "node dist/cli/goat.js doctor",

28 "prepack": "npm run build",

29 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "docs:unwrap": "node scripts/unwrap-markdown.mjs README.md CHANGELOG.md AGENTS.md"

31 },

32 "files": [

33 "dist/",

34 "!dist/__tests__/",

35 "!dist/**/*.map",

36 "scripts/",

37 "skills/",

38 "prompts/",

39 "templates/",

40 "hooks/",

41 "crates/",

42 "Cargo.toml",

43 "Cargo.lock",

44 ".codex-plugin/",

45 ".agents/plugins/marketplace.json",

46 "README.md",

47 "LICENSE"

48 ],

49 "keywords": [

hooks/goat-hook.mjsView file

Lines 42-82javascript

42 if (raw.trim().length === 0) {

43 process.stdout.write("{}");

44 return;

45 }

46

47 const

dist/cli/commands/setup.jsView file

Lines 1-21javascript

1import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";

2import { homedir } from "node:os";

3import { join } from "node:path";

4import { ensureDir, readJson, writeFileAtomic, writeJsonAtomic } from "../../core/fsx.js"

dist/cli/launch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/launch.js#virtual:normalized:round1View on unpkg

dist/setup/native-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codex-goat@0.1.5 matchedIdentity = npm:Y29kZXgtZ29hdA:0.1.5 similarity = 0.514 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/setup/native-runtime.jsView on unpkg