Loading npm security reports…

codexskin-hub@0.2.0: AI-agent control-surface risk | LPM Firewall

registry / codexskin-hub / 0.2.0

codexskin-hub@0.2.0

Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the globally installed CodexHost launcher and renderer. The modified launcher loads package-controlled code and can start a detached supervisor on future CodexHost launches.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall when the Dream Skin engine is present.

Impact

The package gains persistent code execution through the global CodexHost control surface.

Mechanism

Automatic patching of a foreign AI-agent launcher and renderer.

Policy narrative

The postinstall hook runs install.mjs without a separate user setup action. When its engine check passes, it invokes the patcher, which locates the global @codexhost/cli installation and rewrites its launcher and renderer. The injected launcher dynamically imports a hook from this package's runtime directory and can start a detached supervisor whenever CodexHost launches. This is unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The automatic lifecycle hook modifies a foreign global CodexHost launcher and renderer, then arranges later execution of package-controlled code. Explicit setup download behavior does not remove this independent install-time control-surface mutation.

Evidence

package.jsoninstall.mjssrc/patch.mjs%LOCALAPPDATA%\CodexSkinHub\src%APPDATA%\npm\node_modules\@codexhost\cli\bin\codexhost.js%APPDATA%\npm\node_modules\@codexhost\cli\node_modules\@codexhost\cli-win32-x64\app\renderer-extension.js

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

uninstall.mjsView file

17import { fileURLToPath } from "node:url"; L18: import { spawnSync } from "node:child_process"; L19: import { homedir } from "node:os";

High

Child Process

Package source references child process execution.

uninstall.mjsView on unpkg · L17

install.mjsView file

101L102: // 5. PATH shim (pure ASCII - see GBK/PowerShell 5.1 encoding lessons). L103: mkdirSync(dirname(SHIM), { recursive: true });

High

Shell

Package source references shell execution.

install.mjsView on unpkg · L101

src/patch.mjsView file

115try { L116: dreamSkinHook = await import(pathToFileURL(dreamSkinHookPath).href); L117: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/patch.mjsView on unpkg · L115

src/cli.mjsView file

16L17: import { spawn, execFile, spawnSync } from "node:child_process"; L18: import fs from "node:fs"; L19: import fsp from "node:fs/promises"; L20: import http from "node:http"; L21: import path from "node:path"; ... L27: // only referenced. Override the engine root via config.json if needed. L28: const HUB_ROOT = path.join(process.env.LOCALAPPDATA ?? "", "CodexSkinHub"); L29: function loadConfig() {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/cli.mjsView on unpkg · L16

16L17: import { spawn, execFile, spawnSync } from "node:child_process"; L18: import fs from "node:fs"; L19: import fsp from "node:fs/promises"; L20: import http from "node:http"; L21: import path from "node:path"; ... L27: // only referenced. Override the engine root via config.json if needed. L28: const HUB_ROOT = path.join(process.env.LOCALAPPDATA ?? "", "CodexSkinHub"); L29: function loadConfig() { L30: try { L31: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L32: } catch {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/cli.mjsView on unpkg · L16

16Trigger-reachable chain: manifest.bin -> src/cli.mjs L16: L17: import { spawn, execFile, spawnSync } from "node:child_process"; L18: import fs from "node:fs"; L19: import fsp from "node:fs/promises"; L20: import http from "node:http"; L21: import path from "node:path"; ... L27: // only referenced. Override the engine root via config.json if needed. L28: const HUB_ROOT = path.join(process.env.LOCALAPPDATA ?? "", "CodexSkinHub"); L29: function loadConfig() { L30: try { L31: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L32: } catch {

Source & flagged code

8 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "codexskin-hub",

3 "version": "0.2.0",

4 "description": "Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host",

5 "type": "module",

6 "bin": {

7 "codexskin": "src/cli.mjs"

8 },

9 "files": [

10 "src",

11 "install.mjs",

12 "uninstall.mjs",

13 "README.md"

14 ],

15 "os": [

16 "win32"

17 ],

18 "scripts": {

19 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "uninstall": "node uninstall.mjs",

21 "doctor": "node src/cli.mjs doctor",

22 "patch": "node src/patch.mjs",

23 "status": "node src/patch.mjs status",

24 "revert": "node src/patch.mjs --revert"

25 },

26 "engines": {

27 "node": ">=20.11"

28 },

29 "keywords": [

30 "codex",

31 "codexhost",

32 "theme",

33 "dream-skin",

34 "windows"

35 ],

36 "author": "alleyf",

37 "license": "MIT"

38}

39

uninstall.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2// uninstall.mjs - reverse of install.mjs.

3//

4// node uninstall.mjs

5//

6// 1. strips the codexhost bin/renderer patches back to stock (anchor-safe,

7// refuses to touch files whose layout it does not recognize)

8// 2. removes the PATH shim and the optional startup entry

9// 3. removes the runtime home %LOCALAPPDATA%\CodexSkinHub

10//

11// The Dream Skin installation, the theme library and Codex itself are left

install.mjsView file

Lines 81-121javascript

81const hubState = join(HUB_ROOT, "codexskin.json");

82if (legacyState && existsSync(legacyState) && !existsSync(hubState)) {

83 writeFileSync(hubState,

src/patch.mjsView file

Lines 95-135javascript

95

96// ---------------------------------------------------------------------------

97// Patch A - bin/codexhost.js

98// A1: hook import + `theme` subcommand dispatch (before startupTrace entry)

99// A2: superviseDetached() on launch

100// A3: --help extension (best effort, never fatal)

101// ---------------------------------------------------------------------------

102function binBlock1(eol) {

103

src/cli.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// codexskin - fuses BytePioneer-AI/codex-host with Fei-Away/Codex-Dream-Skin.

3//

4// codexskin start [--theme <name>] start codexhost + auto-inject + self-healing supervisor

5// codexskin theme [<name>] switch theme live (no Codex restart) / list themes

6// codexskin status show endpoint / injector / theme state

7// codexskin down stop codexhost supervisor and the theme injector

8//

9// How it works:

10// - Dream Skin themes are injected at runtime over CDP. The injector watch loop