Loading npm security reports…

codex-supervisor-mcp: Suspicious npm security report (Warn) | LPM Firewall

registry / codex-supervisor-mcp / 0.7.3

codex-supervisor-mcp@0.7.3

MCP server that dispatches and supervises parallel Codex CLI workers, one isolated Git worktree each, with a persisted work state machine.

AI Security Review

scanned 20h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Global npm installation can automatically add the package's skill and register its MCP server with detected agent clients. This is a package-owned integration, but it changes agent configuration without a separate setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A global npm install runs the package postinstall hook, unless setup is skipped with its environment variable.

Impact

The installed skill becomes available to agent clients and the MCP server is added to their configuration.

Mechanism

The setup script detects clients, copies or updates the bundled skill in their skill directories, and invokes client commands to register the package MCP server.

AI rationale

The postinstall hook performs package-owned agent skill and MCP setup for detected clients during global installation. This is a guarded integration lifecycle risk under the review policy, with no inspected evidence of credential theft, remote payload execution, or broader control hijacking.

Evidence

package.jsonsrc/setup.jssrc/skill-sync.js

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/setup.js --auto --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/setup.js --auto --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/bin-resolver.js#virtual:normalized:round1View file

67* and the executable bit survive - which a checkout or a copy can drop. This L68: * matters for `CODEX_BIN`, whose natural value is the npm package"s own entry\n * point (`node_modules/@openai/codex/bin/codex.js`) - the same file the shim\n * bypass produces.\n ... L69: * - any non-win32 platform - macOS and Linux behaviour must not change

High

Child Process

Package source references child process execution.

src/bin-resolver.js#virtual:normalized:round1View on unpkg · L67

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

11import { mkdir, readFile, writeFile } from "node:fs/promises"; L12: import { execFileSync } from "node:child_process"; L13: import { basename, dirname, join, resolve } from "node:path"; ... L21: export const INSTALL_COMMAND = `npm i -g ${PACKAGE_NAME}@latest`; L22: const DEFAULT_REGISTRY = "https://registry.npmjs.org"; L23: const CACHE_TTL_MS = 60 * 60 * 1000; ... L26: function registryUrl() { L27: return (process.env.CODEX_SUPERVISOR_REGISTRY?.trim() || DEFAULT_REGISTRY).replace(/\/+$/, ""); L28: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/update-check.jsView on unpkg · L11

•matchType = previous_version_dangerous_delta matchedPackage = codex-supervisor-mcp@0.6.0 matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.6.0 similarity = 0.632 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/update-check.jsView on unpkg

src/setup.jsView file

20Install-time code directly mutates a foreign AI-agent control surface: L42: { L43: ...SKILL_ROOTS.claude, L44: binary: "claude", ... L47: }, L48: { ...SKILL_ROOTS.agents, binary: null }, L49: { L50: ...SKILL_ROOTS.codex, L51: binary: "codex", ... L231: if (options.auto) { L232: if (process.env.CODEX_SUPERVISOR_SKIP_SETUP) { L233: return 0; Write operation from src/skill-sync.js: L20: return { L21: claude: { id: "claude", label: "Claude Code", skillRoot: join(home, ".claude", "skills") }, L22: agents: { id: "agents", label: "~/.agents", skillRoot: join(home, ".agents", "skills") }, L23: codex: { id: "codex", label: "Codex", skillRoot: join(home, ".codex", "skills") } L24: }; ... L69: } L70: await mkdir(dirname(destination), { recursive: true }); L71: await writeAtomically(destination, sourc

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/setup.jsView on unpkg · L20

src/codex-runner.jsView file

•matchType = token_shingles matchedPackage = codex-supervisor-mcp@0.5.9 matchedPath = src/codex-runner.js matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.9 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/codex-runner.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 40-80json

40 "src/worktree.js",

41 "src/landing.js",

42 "src/truncate.js",

43 "src/status.js",

44 "src/paths.js",

45 "src/prompt.js",

46 "src/cleanup.js",

47 "src/monitor.jsx",

48 "src/web-server.js",

49 "src/web-app.js",

50 "src/side-chat.js",

51 "src/update-check.js",

52 "src/auto-update-worker.js",

53 "src/auto-update.js",

54 "web/dist/",

55 "skills/",

56 "README.md",

57 "LICENSE"

58 ],

59 "scripts": {

60 "postinstall": "node ./src/setup.js --auto --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "setup": "node ./src/setup.js",

62 "start": "node ./src/mcp-server.js",

63 "monitor": "tsx ./src/monitor.jsx",

64 "cleanup": "node ./src/cleanup.js",

65 "test": "node ./src/bin-resolver-test.js && node ./src/truncate-test.js && node ./src/status-test.js && node ./src/migration-test.js && node ./src/setup-test.js && node ./src/setup-windows-test.js && node ./src/regression-test.js && node --test test/edge/*.test.js",

66 "test:real": "node ./src/real-codex-test.js",

67 "smoke": "node ./src/smoke-test.js",

68 "smoke:followup": "node ./src/followup-smoke-test.js",

69 "smoke:mcp": "node ./src/mcp-smoke-test.js",

70 "smoke:mcp-wait": "node ./src/mcp-wait-smoke-test.js",

71 "web": "node ./src/web-server.js",

72 "web:install": "npm --prefix web install",

73 "web:build": "npm --prefix web run build",

74 "web:dev": "npm --prefix web run dev",

75 "test:edge": "node --test test/edge/*.test.js",

76 "prepublishOnly": "npm run web:build && npm test"

77 },

78 "dependencies": {

79 "@modelcontextprotocol/sdk": "^1.21.0"

80 },

src/bin-resolver.js#virtual:normalized:round1View file

67* and the executable bit survive - which a checkout or a copy can drop. This L68: * matters for `CODEX_BIN`, whose natural value is the npm package"s own entry\n * point (`node_modules/@openai/codex/bin/codex.js`) - the same file the shim\n * bypass produces.\n ... L69: * - any non-win32 platform - macOS and Linux behaviour must not change

High

Child Process

Package source references child process execution.

src/bin-resolver.js#virtual:normalized:round1View on unpkg · L67

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

Lines 1-31javascript

1// Is the running copy the latest published one? Asked once per MCP start and

2// again every few hours, answered from the npm registry, cached on disk so a

3// burst of MCP processes does not turn into a burst of registry calls.

4//

5// Two things are compared. The version, against the registry's `latest`

6// dist-tag. And the tarball integrity: a global install records the

7// integrity of what npm unpacked in node_modules/.package-lock.json, and

8// the registry says what the integrity of that version should be. A

9// mismatch means the files on disk are not the published build.

10

src/setup.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// Installs the codex-supervisor skill into the skill directories of the agent

3// clients found on this machine, and registers the MCP server with them.

4//

5// Runs automatically after a *global* npm install (`postinstall`), and can be

6// invoked directly to repair or re-run setup:

7//

8// npx codex-supervisor-setup

9// codex-supervisor-setup --target claude --force

10//

11// Set CODEX_SUPERVISOR_SKIP_SETUP=1 to opt out of the automatic run.

src/codex-runner.jsView file

•matchType = token_shingles matchedPackage = codex-supervisor-mcp@0.5.9 matchedPath = src/codex-runner.js matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.9 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/codex-runner.jsView on unpkg