registry / codex-mobile-re / 0.1.101

codex-mobile-re@0.1.101

Mobile-first web interface and gateway for Codex app-server (fork rebuild of codexapp)

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Running the CLI starts a Codex bridge that changes the user's Codex instruction path. Android startup also fetches and overwrites the shared skills directory from a third-party GitHub repository.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the codex-mobile-re CLI/server.

Impact

Remote skill content can influence Codex sessions run with full filesystem access and no approval prompts.

Mechanism

automatic remote skills bootstrap and AGENTS.md symlink replacement

AI rationale

Source confirms a concrete, high-impact agent-extension lifecycle risk and unsafe execution defaults. The install hook is limited to node-pty repair, so the package does not meet the policy threshold for an install-time block.

Evidence

package.jsonscripts/fix-pty-native-build.cjsdist-cli/index.jsCODEX_HOME/AGENTS.mdCODEX_HOME/skills/AGENTS.mdCODEX_HOME/skills/

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

CLI defaults Codex app-server to danger-full-access with approval_policy never.
Server startup replaces CODEX_HOME/AGENTS.md with a symlink to skills/AGENTS.md.
On Android, startup automatically clones OpenClawAndroid/skills into the Codex skills directory with overwrite enabled.
Skills sync is invoked during bridge initialization, not only through a sync endpoint.

Evidence against

postinstall only repairs the node-pty native build; it does not alter AI-agent configuration.
The risky behavior activates when the user runs the package CLI/server, not during npm installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 2.10 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.example.com, api.github.com, api.openai.com, apis.google.com, auth.openai.com, backend.composio.dev, chatgpt.com, composio.dev, dashboard.composio.dev, github.com, opencode.ai, openrouter.ai, raw.githubusercontent.com, skills.anyclaw.store, vuejs.org, www.google.com, www.w3.org

Source & flagged code

18 flagged

package.jsonView file

Lines 34-74json

34 "dist-cli/",

35 "scripts/dev.cjs",

36 "scripts/dev-random-home.cjs",

37 "scripts/fix-pty-native-build.cjs"

38 ],

39 "pnpm": {

40 "onlyBuiltDependencies": [

41 "@firebase/util",

42 "esbuild",

43 "node-pty",

44 "protobufjs"

45 ]

46 },

47 "scripts": {

48 "dev": "node scripts/dev.cjs",

49 "dev2": "node scripts/dev-random-home.cjs",

50 "dev:open": "pnpm run build:cli && sh -c 'pnpm run dev & VPID=$!; node dist-cli/index.js --open-project \"${1:-.}\"; wait $VPID' --",

51 "build:frontend": "vue-tsc --noEmit && vite build",

52 "build:cli": "tsup",

53 "build": "pnpm run build:frontend && pnpm run build:cli",

54 "postinstall": "node scripts/fix-pty-native-build.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 "test:unit": "vitest run",

56 "preview": "vite preview",

57 "prepublishOnly": "pnpm run build",

58 "profile:browser": "node scripts/profile-browser-runtime.cjs",

59 "profile:thread": "PROFILE_ROUTE='#/thread/019da7c0-4e12-7a91-837c-f7c11cc8ab6c' node scripts/profile-browser-runtime.cjs"

60 },

61 "dependencies": {

62 "@composio/client": "0.1.0-alpha.66",

63 "@xterm/addon-fit": "^0.11.0",

64 "@xterm/xterm": "^6.0.0",

65 "commander": "^13.1.0",

66 "express": "^5.1.0",

67 "firebase": "^12.2.1",

68 "highlight.js": "^11.11.1",

69 "qrcode-terminal": "^0.12.0",

70 "ws": "^8.18.3"

71 },

72 "optionalDependencies": {

73 "node-pty": "^1.1.0"

74 },

dist/assets/DirectoryHub-C4D0oVqF.jsView file

Lines 1-3javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index.esm-Cxn_LBGD.js","assets/index.esm-Bx2Y2PLG.js","assets/index.esm-DYMAm9mq.js"])))=>i.map(i

dist/assets/common-BeuopZEI.jsView file

Lines 1-6javascript

1function ur(r){return r&&r.__esModule&&Object.prototype.hasOwnProperty.call(r,"default")?r.default:r}var fn,lt;function gr(){

dist-cli/index.jsView file

3Source sends the broad process environment to a literal external destination. L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist-cli/index.jsView on unpkg · L3

50return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

High

Shell

Package source references shell execution.

dist-cli/index.jsView on unpkg · L50

3Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args

scripts/dev.cjsView file

1Cross-file remote execution chain: scripts/dev.cjs spawns dist-cli/index.js; helper contains network access plus dynamic code execution. L1: const { execFileSync, spawnSync } = require('node:child_process') L2: const { existsSync } = require('node:fs') ... L5: function isAndroidRuntime() { L6: if (process.platform === 'android') return true L7: if (process.env.TERMUX_VERSION) return true L8: if (process.env.PREFIX?.includes('/com.termux/')) return true ... L40: const passthroughArgs = process.argv.slice(2) L41: const viteBinPath = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'vite.cmd' : 'vite') L42: const vueTscBinPath = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'vue-tsc.cmd' : 'vue-tsc')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/dev.cjsView on unpkg · L1

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-native-build.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/assets/DirectoryHub-C4D0oVqF.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = import{d...lt};

High

High Secret

Package contains a high-severity secret pattern.

dist/assets/DirectoryHub-C4D0oVqF.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2 matchedText = import{d...lt};

High

Secret Pattern

Google API key in dist/assets/DirectoryHub-C4D0oVqF.js

dist/assets/DirectoryHub-C4D0oVqF.jsView on unpkg · L2

dist/assets/common-BeuopZEI.jsView file

1function ur(r){return r&&r.__esModule&&Object.prototype.hasOwnProperty.call(r,"default")?r.default:r}var fn,lt;function gr(){if(lt)return fn;lt=1;function r(n){return n instanceof ... L2: https://github.com/highlightjs/highlight.js/issues/2277`),te=u,q=A),P===void 0&&(P=!0);const fe={code:q,language:te};Je("before:highlight",fe);const Re=fe.result?fe.result:ze(fe.la...

High

Child Process

Package source references child process execution.

dist/assets/common-BeuopZEI.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = codex-mobile-re@0.1.97 matchedPath = dist/assets/common-BeuopZEI.js matchedIdentity = npm:Y29kZXgtbW9iaWxlLXJl:0.1.97 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/common-BeuopZEI.jsView on unpkg

dist-cli/index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist-cli/index.jsView on unpkg · L3

50return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

High

Shell

Package source references shell execution.

dist-cli/index.jsView on unpkg · L50

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-cli/index.jsView on unpkg · L3

1293} L1294: const proc = spawn("codex", ["login"], { L1295: env: process.env, L1296: stdio: ["pipe", "pipe", "pipe"] ... L1305: exitSignal: null, L1306: exitPromise: new Promise((resolve4) => { L1307: proc.once("exit", (code, signal) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-cli/index.jsView on unpkg · L1293

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist-cli/index.js: import { readFile as readFile5, stat as stat8, writeFile as writeFile6 } from "fs/promises"; import { createInterface as createInterface2 } from "readline/promises"; const explicit = process.env.CODEXUI_CODEX_COMMAND?.trim(); const explicit = process.env.CODEXUI_RG_COMMAND?.trim(); const candidate = normalizeRuntimeValue(process.env.CODEXUI_SANDBOX_MODE); const candidate = normalizeRuntimeValue(process.env.CODEXUI_APPROVAL_POLICY); const codexHome = process.env.CODEX_HOME?.trim() ?? ""; return codexHome && codexHome.length > 0 ? codexHome : join2(homedir2(), ".codex");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist-cli/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist-cli/index.js: import { readFile as readFile5, stat as stat8, writeFile as writeFile6 } from "fs/promises"; const dirs = [join(prefix, "node_modules", "@openai", "codex")]; dirs.push(join(prefix, "lib", "node_modules", "@openai", "codex")); join(packageDir, "node_modules", "@openai", "codex-win32-x64", "vendor", "x86_64-pc-windows-msvc", "codex", "codex.exe"), "node_modules", "node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex\\codex.exe" const match = shimContent.match(/([^"'\r\n]*node_modules[\\/]@openai[\\/]codex)/i); const markerPath = "node_modules\\@openai\\codex";

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist-cli/index.jsView on unpkg

1293} L1294: const proc = spawn("codex", ["login"], { L1295: env: process.env, ... L1297: }); L1298: proc.stdin.end(); L1299: activeLogin = { ... L1303: exited: false, L1304: exitCode: null, L1305: exitSignal: null, L1306: exitPromise: new Promise((resolve4) => { L1307: proc.once("exit", (code, signal) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-cli/index.jsView on unpkg · L1293

3Detached bundled service listener: dist-cli/index.js launches a Node helper and exposes a broad-bound HTTP listener. L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist-cli/index.jsView on unpkg · L3

1293Trigger-reachable command-output exfiltration chain: manifest.bin -> dist-cli/index.js L1293: } L1294: const proc = spawn("codex", ["login"], { L1295: env: process.env, ... L1297: }); L1298: proc.stdin.end(); L1299: activeLogin = { ... L1303: exited: false, L1304: exitCode: null, L1305: exitSignal: null, L1306: exitPromise: new Promise((resolve4) => { L1307: proc.once("exit", (code, signal) => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist-cli/index.jsView on unpkg · L1293

•matchType = normalized_sha256 matchedPackage = codex-mobile-re@0.1.97 matchedPath = dist-cli/index.js matchedIdentity = npm:Y29kZXgtbW9iaWxlLXJl:0.1.97 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-cli/index.jsView on unpkg

15423patternName = generic_password severity = medium line = 15423 matchedText = const pr...th);

Medium

Secret Pattern

Hardcoded password in dist-cli/index.js

dist-cli/index.jsView on unpkg · L15423

3// src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist-cli/index.jsView on unpkg · L3

scripts/dev.cjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/dev.cjsView on unpkg · L1

Findings

1 Critical15 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist-cli/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretdist/assets/DirectoryHub-C4D0oVqF.js

HighChild Processdist/assets/common-BeuopZEI.js

HighShelldist-cli/index.js

HighEntrypoint Build Divergencedist-cli/index.js

HighSame File Env Network Executiondist-cli/index.js

HighCredential Redirect Persistencedist-cli/index.js

HighEntrypoint Foreign Package Code Overwritedist-cli/index.js

HighCommand Output Exfiltrationdist-cli/index.js

HighCross File Remote Execution Contextscripts/dev.cjs

HighSpawned Bundled Service Listenerdist-cli/index.js

HighTrigger Reachable Command Output Exfiltrationdist-cli/index.js

HighKnown Malware Source Similaritydist-cli/index.js

HighKnown Malware Source Similaritydist/assets/common-BeuopZEI.js

HighSecret Patterndist/assets/DirectoryHub-C4D0oVqF.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist-cli/index.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist-cli/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to codex-mobile-re@0.1.101.

See version security history for other recorded verdicts.

Review the evidence and your use of codex-mobile-re@0.1.101 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-20 10:17:33.854Z (UTC).