Loading npm security reports…

codex-supervisor-mcp@0.5.9: AI-agent control-surface risk | LPM Firewall

registry / codex-supervisor-mcp / 0.5.9

codex-supervisor-mcp@0.5.9

MCP server that dispatches and supervises parallel Codex CLI workers, one isolated Git worktree each, with a persisted work state machine.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically configures detected AI agent clients. The hook installs the package skill and registers its MCP server in those clients' user configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation, unless CODEX_SUPERVISOR_SKIP_SETUP is set.

Impact

Agent clients may load the package skill and MCP server in future sessions.

Mechanism

The postinstall invokes setup in auto mode, which writes skill files and uses client commands to add the MCP server without prompting for consent.

Policy narrative

During global installation, the postinstall hook silently installs a skill and registers the package's MCP server with detected Claude Code or Codex clients. This changes their future agent behavior without an interactive consent step; the setup is opt-out through an environment variable.

AI rationale

The unconsented global npm postinstall mutates multiple AI agent control surfaces by installing a skill and registering an MCP server. This meets the policy for blocking an install-time agent control hijack.

Evidence

package.jsonsrc/setup.js~/.claude/skills/codex-supervisor/SKILL.md~/.agents/skills/codex-supervisor/SKILL.md~/.codex/skills/codex-supervisor/SKILL.md

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/setup.js --auto --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/setup.js --auto --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/bin-resolver.js#virtual:normalized:round1View file

67* and the executable bit survive - which a checkout or a copy can drop. This L68: * matters for `CODEX_BIN`, whose natural value is the npm package"s own entry\n * point (`node_modules/@openai/codex/bin/codex.js`) - the same file the shim\n * bypass produces.\n ... L69: * - any non-win32 platform - macOS and Linux behaviour must not change

High

Child Process

Package source references child process execution.

src/bin-resolver.js#virtual:normalized:round1View on unpkg · L67

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

11import { mkdir, readFile, writeFile } from "node:fs/promises"; L12: import { execFileSync } from "node:child_process"; L13: import { dirname, join, resolve } from "node:path"; ... L21: export const INSTALL_COMMAND = `npm i -g ${PACKAGE_NAME}@latest`; L22: const DEFAULT_REGISTRY = "https://registry.npmjs.org"; L23: const CACHE_TTL_MS = 60 * 60 * 1000; ... L26: function registryUrl() { L27: return (process.env.CODEX_SUPERVISOR_REGISTRY?.trim() || DEFAULT_REGISTRY).replace(/\/+$/, ""); L28: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/update-check.jsView on unpkg · L11

src/setup.jsView file

44label: "Claude Code", L45: skillRoot: join(homedir(), ".claude", "skills"), L46: binary: "claude", ... L49: }, L50: { id: "agents", label: "~/.agents", skillRoot: join(homedir(), ".agents", "skills"), binary: null }, L51: { ... L53: label: "Codex", L54: skillRoot: join(homedir(), ".codex", "skills"), L55: binary: "codex", ... L208: } L209: await mkdir(dirname(destination), { recursive: true }); L210: await writeFile(destination, source);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/setup.jsView on unpkg · L44

•matchType = normalized_sha256 matchedPackage = codex-supervisor-mcp@0.5.3 matchedPath = src/setup.js matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/setup.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 34-74json

34 "src/codex-runner.js",

35 "src/task-store.js",

36 "src/goal-store.js",

37 "src/event-parser.js",

38 "src/worktree.js",

39 "src/truncate.js",

40 "src/status.js",

41 "src/paths.js",

42 "src/prompt.js",

43 "src/cleanup.js",

44 "src/monitor.jsx",

45 "src/web-server.js",

46 "src/web-app.js",

47 "src/update-check.js",

48 "web/dist/",

49 "skills/",

50 "README.md",

51 "LICENSE"

52 ],

53 "scripts": {

54 "postinstall": "node ./src/setup.js --auto --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "setup": "node ./src/setup.js",

56 "start": "node ./src/mcp-server.js",

57 "monitor": "tsx ./src/monitor.jsx",

58 "cleanup": "node ./src/cleanup.js",

59 "test": "node ./src/bin-resolver-test.js && node ./src/truncate-test.js && node ./src/status-test.js && node ./src/migration-test.js && node ./src/setup-test.js && node ./src/setup-windows-test.js && node ./src/regression-test.js && node --test test/edge/*.test.js",

60 "test:real": "node ./src/real-codex-test.js",

61 "smoke": "node ./src/smoke-test.js",

62 "smoke:followup": "node ./src/followup-smoke-test.js",

63 "smoke:mcp": "node ./src/mcp-smoke-test.js",

64 "smoke:mcp-wait": "node ./src/mcp-wait-smoke-test.js",

65 "web": "node ./src/web-server.js",

66 "web:install": "npm --prefix web install",

67 "web:build": "npm --prefix web run build",

68 "web:dev": "npm --prefix web run dev",

69 "test:edge": "node --test test/edge/*.test.js",

70 "prepublishOnly": "npm run web:build && npm test"

71 },

72 "dependencies": {

73 "@modelcontextprotocol/sdk": "^1.21.0"

74 },

src/bin-resolver.js#virtual:normalized:round1View file

67* and the executable bit survive - which a checkout or a copy can drop. This L68: * matters for `CODEX_BIN`, whose natural value is the npm package"s own entry\n * point (`node_modules/@openai/codex/bin/codex.js`) - the same file the shim\n * bypass produces.\n ... L69: * - any non-win32 platform - macOS and Linux behaviour must not change

High

Child Process

Package source references child process execution.

src/bin-resolver.js#virtual:normalized:round1View on unpkg · L67

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

Lines 1-31javascript

1// Is the running copy the latest published one? Asked once per MCP start and

2// again every few hours, answered from the npm registry, cached on disk so a

3// burst of MCP processes does not turn into a burst of registry calls.

4//

5// Two things are compared. The version, against the registry's `latest`

6// dist-tag. And the tarball integrity: a global install records the

7// integrity of what npm unpacked in node_modules/.package-lock.json, and

8// the registry says what the integrity of that version should be. A

9// mismatch means the files on disk are not the published build.

10

src/setup.jsView file

Lines 24-64javascript

24} from "./bin-resolver.js";

25

26const run = promisify(execFile);

27

28const packageRoot = dirname(dirname(fileURLToPath(