registry / Install hook abuse / codexskin-hub

codexskin-hub

Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host

This report shows the evidence for codexskin-hub@0.4.8. 7 of 7 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The automatic postinstall chain modifies another package's launcher and renderer, then makes the modification self-healing and persistent across normal launches. This meets the install-hook abuse policy even though secret theft was not established.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when a Dream Skin engine is detected; later normal codexhost launches.

Impact

A package install silently changes a foreign AI-agent control surface and arranges ongoing execution of package code.

Mechanism

Postinstall patch injection and detached CDP supervisor persistence.

Attack narrative

On postinstall, the package copies itself to a user runtime directory and, when its engine is present, runs a patcher against a separately installed @codexhost/cli. That patch injects a dynamic import of this package's hook and a detached supervisor call into the foreign CLI, and alters its renderer. The hook silently reapplies the patch after restoration and starts a detached supervisor. The supervisor then uses local CDP Runtime.evaluate against Codex application targets. This is unconsented install-time mutation and persistence in a foreign AI-agent control surface.

AI rationale

Evidence

package.jsoninstall.mjssrc/patch.mjssrc/hook.mjssrc/cli.mjssrc/config.json~/.local/bin/codexskin@codexhost/cli/bin/codexhost.js@codexhost/cli/node_modules/@codexhost/*/app/renderer-extension.js

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs install.mjs automatically through a postinstall hook.
The installer copies a persistent runtime, then automatically invokes its patcher when the Dream Skin engine is present.
The patcher finds the separately installed @codexhost/cli package and overwrites its bin and renderer files.
The injected bin code dynamically imports this package's hook and invokes a detached supervisor during normal codexhost launches.
The hook silently reapplies patches and launches a detached supervisor.
The supervisor attaches to Codex's local CDP endpoint and evaluates code in application targets.

Evidence against

No source evidence of credential harvesting or remote secret exfiltration was found.
External downloads are limited to the explicit setup command; they are not required by postinstall.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Source & flagged code

21 flagged

package.jsonView file

Lines 1-40json

2 "name": "codexskin-hub",

3 "version": "0.4.8",

4 "description": "Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host",

5 "type": "module",

6 "bin": {

7 "codexskin": "src/cli.mjs"

8 },

9 "files": [

10 "src",

11 "install.mjs",

12 "uninstall.mjs",

13 "README.md"

14 ],

15 "os": [

16 "win32",

17 "darwin"

18 ],

19 "scripts": {

20 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "uninstall": "node uninstall.mjs",

22 "doctor": "node src/cli.mjs doctor",

23 "patch": "node src/patch.mjs",

24 "status": "node src/patch.mjs status",

25 "revert": "node src/patch.mjs --revert"

26 },

27 "engines": {

28 "node": ">=20.11"

29 },

30 "keywords": [

31 "codex",

32 "codexhost",

33 "theme",

34 "dream-skin",

35 "windows",

36 "macos"

37 ],

38 "author": "alleyf",

39 "license": "MIT",

40 "repository": {

uninstall.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// uninstall.mjs - reverse of install.mjs.

3//

4// node uninstall.mjs

5//

6// 1. strips the codexhost bin/renderer patches back to stock (anchor-safe,

7// refuses to touch files whose layout it does not recognize)

8// 2. removes the PATH shim and the optional startup entry

9// 3. removes the runtime home (per-OS: %LOCALAPPDATA%\CodexSkinHub,

10// ~/Library/Application Support/CodexSkinHub, XDG data home)

src/discover.mjsView file

Lines 2-42javascript

2// single npm prefix (issue #2: nvm-windows and custom `npm config set prefix`

3// layouts keep global packages outside %APPDATA%\npm). No side effects on

4// import - both cli.mjs and patch.mjs share this helper.

5import { existsSync, readFileSync } from "node:fs";

6import { join } from "node:path";

7import { spawnSync } from

src/tools/check-payload-render.cjsView file

Lines 40-80javascript

40// A mock element that swallows unknown property access and returns chainable

41// stubs - enough for building a card grid without a real DOM.

42const mockClassList = { add() {}, remove() {}, toggle() {}, contains: () => false };

43function

src/patch.mjsView file

Lines 87-127javascript

88// ---------------------------------------------------------------------------

89// Patch A - bin/codexhost.js

90// A1: hook import + `theme` subcommand dispatch (before startupTrace entry)

91// A2: superviseDetached() on launch

92// A3: --help extension (best effort, never fatal)

93// ---------------------------------------------------------------------------

94function binBlock1(eol, hookCandidates) {

install.mjsView file

Lines 4-44javascript

4// node install.mjs # install / upgrade (idempotent)

5// node install.mjs --startup # also register a per-user startup entry

6//

7// What it does:

8// 1. copies src/ to the runtime home %LOCALAPPDATA%\CodexSkinHub\src

9// (the repo itself can be moved or deleted afterwards)

10// 2. writes config.json pointing at the Dream Skin engine root

11// 3. migrates codexskin.json (active theme state) from the legacy

12// CodexDreamSkin directory when present

13// 4. applies the codexhost bin/renderer patches (idempotent, anchor-safe)

src/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// codexskin - fuses BytePioneer-AI/codex-host with Fei-Away/Codex-Dream-Skin.

3//

4// codexskin start [--theme <name>] start codexhost + auto-inject + self-healing supervisor

5// codexskin theme [<name>] switch theme live (no Codex restart) / list themes

6// codexskin status show endpoint / injector / theme state

7// codexskin down stop codexhost supervisor and the theme injector

8//

9// How it works:

10// - Dream Skin themes are injected at runtime over CDP. The injector watch loop

src/hook.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/hook.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High