registry / codex-plus-patcher / 0.22.0

codex-plus-patcher@0.22.0

Patch queue tool for building local ChatGPT Plus or Codex Plus apps from installed OpenAI desktop apps.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `codex-plus-patcher apply`, selects release mode, or uses injected runtime UI actions.

Impact

A consenting user can run code from a selected release patch archive and grant the patched app workflow/package-management capabilities.

Mechanism

Explicit app-bundle patching with optional remote patch-module loading and agent workflow controls.

Rationale

Source inspection shows a user-invoked desktop-app patcher with optional remote module loading and agent workflow/package capabilities, not a concrete malicious chain. Warn because these control surfaces are high-impact and include dynamically loaded release code.

Evidence

package.jsonsrc/cli.jssrc/core/release.jssrc/core/patch-engine.jssrc/runtime/host/nativeMain.jssrc/runtime/host/aharnessService.jsContents/Resources/app.asarContents/Info.plist

Network endpoints1

api.github.com/repos/${repo}/releases/latest

codex-plus-patcher@0.22.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code