codex-supervisor-mcp@0.6.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

codex-supervisor-mcp@0.6.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/setup.js --auto --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/setup.js --auto --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/bin-resolver.js#virtual:normalized:round1View file

67* and the executable bit survive - which a checkout or a copy can drop. This L68: * matters for `CODEX_BIN`, whose natural value is the npm package"s own entry\n * point (`node_modules/@openai/codex/bin/codex.js`) - the same file the shim\n * bypass produces.\n ... L69: * - any non-win32 platform - macOS and Linux behaviour must not change

High

Child Process

Package source references child process execution.

src/bin-resolver.js#virtual:normalized:round1View on unpkg · L67

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

11import { mkdir, readFile, writeFile } from "node:fs/promises"; L12: import { execFileSync } from "node:child_process"; L13: import { dirname, join, resolve } from "node:path"; ... L21: export const INSTALL_COMMAND = `npm i -g ${PACKAGE_NAME}@latest`; L22: const DEFAULT_REGISTRY = "https://registry.npmjs.org"; L23: const CACHE_TTL_MS = 60 * 60 * 1000; ... L26: function registryUrl() { L27: return (process.env.CODEX_SUPERVISOR_REGISTRY?.trim() || DEFAULT_REGISTRY).replace(/\/+$/, ""); L28: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/update-check.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = codex-supervisor-mcp@0.5.9 matchedPath = src/update-check.js matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/setup.jsView file

44label: "Claude Code", L45: skillRoot: join(homedir(), ".claude", "skills"), L46: binary: "claude", ... L49: }, L50: { id: "agents", label: "~/.agents", skillRoot: join(homedir(), ".agents", "skills"), binary: null }, L51: { ... L53: label: "Codex", L54: skillRoot: join(homedir(), ".codex", "skills"), L55: binary: "codex", ... L208: } L209: await mkdir(dirname(destination), { recursive: true }); L210: await writeFile(destination, source);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/setup.jsView on unpkg · L44

•matchType = normalized_sha256 matchedPackage = codex-supervisor-mcp@0.5.9 matchedPath = src/setup.js matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/setup.jsView on unpkg

src/codex-runner.jsView file

•matchType = token_shingles matchedPackage = codex-supervisor-mcp@0.5.9 matchedPath = src/codex-runner.js matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.9 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/codex-runner.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = codex-supervisor-mcp@0.5.7 matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.7 similarity = 0.706 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/codex-runner.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 35-75json

35 "src/task-store.js",

36 "src/goal-store.js",

37 "src/event-parser.js",

38 "src/worktree.js",

39 "src/truncate.js",

40 "src/status.js",

41 "src/paths.js",

42 "src/prompt.js",

43 "src/cleanup.js",

44 "src/monitor.jsx",

45 "src/web-server.js",

46 "src/web-app.js",

47 "src/side-chat.js",

48 "src/update-check.js",

49 "web/dist/",

50 "skills/",

51 "README.md",

52 "LICENSE"

53 ],

54 "scripts": {

55 "postinstall": "node ./src/setup.js --auto --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "setup": "node ./src/setup.js",

57 "start": "node ./src/mcp-server.js",

58 "monitor": "tsx ./src/monitor.jsx",

59 "cleanup": "node ./src/cleanup.js",

60 "test": "node ./src/bin-resolver-test.js && node ./src/truncate-test.js && node ./src/status-test.js && node ./src/migration-test.js && node ./src/setup-test.js && node ./src/setup-windows-test.js && node ./src/regression-test.js && node --test test/edge/*.test.js",

61 "test:real": "node ./src/real-codex-test.js",

62 "smoke": "node ./src/smoke-test.js",

63 "smoke:followup": "node ./src/followup-smoke-test.js",

64 "smoke:mcp": "node ./src/mcp-smoke-test.js",

65 "smoke:mcp-wait": "node ./src/mcp-wait-smoke-test.js",

66 "web": "node ./src/web-server.js",

67 "web:install": "npm --prefix web install",

68 "web:build": "npm --prefix web run build",

69 "web:dev": "npm --prefix web run dev",

70 "test:edge": "node --test test/edge/*.test.js",

71 "prepublishOnly": "npm run web:build && npm test"

72 },

73 "dependencies": {

74 "@modelcontextprotocol/sdk": "^1.21.0"

75 },

src/bin-resolver.js#virtual:normalized:round1View file

67* and the executable bit survive - which a checkout or a copy can drop. This L68: * matters for `CODEX_BIN`, whose natural value is the npm package"s own entry\n * point (`node_modules/@openai/codex/bin/codex.js`) - the same file the shim\n * bypass produces.\n ... L69: * - any non-win32 platform - macOS and Linux behaviour must not change

High

Child Process

Package source references child process execution.

src/bin-resolver.js#virtual:normalized:round1View on unpkg · L67

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/bin-resolver.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

Lines 1-31javascript

1// Is the running copy the latest published one? Asked once per MCP start and

2// again every few hours, answered from the npm registry, cached on disk so a

3// burst of MCP processes does not turn into a burst of registry calls.

4//

5// Two things are compared. The version, against the registry's `latest`

6// dist-tag. And the tarball integrity: a global install records the

7// integrity of what npm unpacked in node_modules/.package-lock.json, and

8// the registry says what the integrity of that version should be. A

9// mismatch means the files on disk are not the published build.

10

src/setup.jsView file

Lines 24-64javascript

24} from "./bin-resolver.js";

25

26const run = promisify(execFile);

27

28const packageRoot = dirname(dirname(fileURLToPath(

src/codex-runner.jsView file

•matchType = token_shingles matchedPackage = codex-supervisor-mcp@0.5.9 matchedPath = src/codex-runner.js matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.9 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/codex-runner.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = codex-supervisor-mcp@0.5.7 matchedIdentity = npm:Y29kZXgtc3VwZXJ2aXNvci1tY3A:0.5.7 similarity = 0.706 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/codex-runner.jsView on unpkg