registry / codex-plus-patcher / 0.12.4

codex-plus-patcher@0.12.4

Patch queue tool for building a local Codex Plus.app from an installed Codex.app.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked CLI that patches a local Codex.app bundle and includes local audit/dev helpers.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI commands such as apply, dev-sync, launch-dev, audit-plugins, or --mode release

Impact

Can write a copied target app, local dev/audit homes, temp Mermaid HTML, and release cache when invoked; no exfiltration or lifecycle execution found

Mechanism

Local app patching and optional user-requested GitHub release download

Rationale

Static inspection shows risky primitives are aligned with a local Codex.app patcher and only triggered by explicit CLI commands. There is no install-time execution, secret harvesting with exfiltration, persistence, destructive behavior beyond user-selected target/cache/dev paths, or unconsented agent-control mutation.

Evidence

package.jsonsrc/cli.jssrc/core/patch-engine.jssrc/core/dev-mode.jssrc/core/plugin-audit.jssrc/core/audit-fixture.jssrc/core/release.jssrc/runtime/host/nativeMain.jssrc/runtime/plugins/devTools.js~/Applications/Codex Plus.appwork/codex-plus-dev-homework/codex-plus-electron-user-data~/.cache/codex-plus-patcher/tmp/codex-plus-mermaid-*.html

codex-plus-patcher@0.12.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code