Loading npm security reports…

codexskin-hub@0.2.2: AI-agent control-surface risk | LPM Firewall

registry / codexskin-hub / 0.2.2

codexskin-hub@0.2.2

Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package modifies a separately installed Codex host launcher and renderer. The modified host loads package code, self-repairs the modification, and runs a detached supervisor with CDP JavaScript evaluation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, followed by launching the patched codexhost program.

Impact

A package install alters a foreign AI-agent control surface and causes later host launches to execute package-controlled code.

Mechanism

Automatic foreign AI-agent host patching with persistent detached CDP control.

Policy narrative

Installing the package automatically runs its installer. When the related engine exists, that installer invokes a patcher against a global @codexhost/cli installation and writes a user command shim. The patch adds dynamic loading of this package's hook into the foreign launcher. On later host launches, the hook silently launches a detached patch-repair process and supervisor. The supervisor discovers the local Codex debugging endpoint and evaluates JavaScript in app pages.

AI rationale

This is unconsented postinstall mutation of a foreign AI-agent control surface, followed by self-healing detached execution and CDP page control. That concrete lifecycle chain meets the publish-block policy even without observed credential theft.

Evidence

package.jsoninstall.mjssrc/patch.mjssrc/hook.mjssrc/cli.mjs%LOCALAPPDATA%\CodexSkinHub\src%USERPROFILE%\.local\bin\codexskin.cmd

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

uninstall.mjsView file

17import { fileURLToPath } from "node:url"; L18: import { spawnSync } from "node:child_process"; L19: import { homedir } from "node:os";

High

Child Process

Package source references child process execution.

uninstall.mjsView on unpkg · L17

install.mjsView file

113L114: // 5. PATH shim (pure ASCII - see GBK/PowerShell 5.1 encoding lessons). L115: mkdirSync(dirname(SHIM), { recursive: true });

High

Shell

Package source references shell execution.

install.mjsView on unpkg · L113

src/patch.mjsView file

115try { L116: dreamSkinHook = await import(pathToFileURL(dreamSkinHookPath).href); L117: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/patch.mjsView on unpkg · L115

src/cli.mjsView file

16L17: import { spawn, execFile, spawnSync } from "node:child_process"; L18: import fs from "node:fs"; L19: import fsp from "node:fs/promises"; L20: import http from "node:http"; L21: import path from "node:path"; ... L27: // only referenced. Override the engine root via config.json if needed. L28: const HUB_ROOT = path.join(process.env.LOCALAPPDATA ?? "", "CodexSkinHub"); L29: function loadConfig() {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/cli.mjsView on unpkg · L16

16L17: import { spawn, execFile, spawnSync } from "node:child_process"; L18: import fs from "node:fs"; L19: import fsp from "node:fs/promises"; L20: import http from "node:http"; L21: import path from "node:path"; ... L27: // only referenced. Override the engine root via config.json if needed. L28: const HUB_ROOT = path.join(process.env.LOCALAPPDATA ?? "", "CodexSkinHub"); L29: function loadConfig() { L30: try { L31: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L32: } catch {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/cli.mjsView on unpkg · L16

16Trigger-reachable chain: manifest.bin -> src/cli.mjs L16: L17: import { spawn, execFile, spawnSync } from "node:child_process"; L18: import fs from "node:fs"; L19: import fsp from "node:fs/promises"; L20: import http from "node:http"; L21: import path from "node:path"; ... L27: // only referenced. Override the engine root via config.json if needed. L28: const HUB_ROOT = path.join(process.env.LOCALAPPDATA ?? "", "CodexSkinHub"); L29: function loadConfig() { L30: try { L31: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L32: } catch {

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.2.1 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg

src/hook.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.2.1 matchedPath = src/hook.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hook.mjsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "codexskin-hub",

3 "version": "0.2.2",

4 "description": "Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host",

5 "type": "module",

6 "bin": {

7 "codexskin": "src/cli.mjs"

8 },

9 "files": [

10 "src",

11 "install.mjs",

12 "uninstall.mjs",

13 "README.md"

14 ],

15 "os": [

16 "win32"

17 ],

18 "scripts": {

19 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "uninstall": "node uninstall.mjs",

21 "doctor": "node src/cli.mjs doctor",

22 "patch": "node src/patch.mjs",

23 "status": "node src/patch.mjs status",

24 "revert": "node src/patch.mjs --revert"

25 },

26 "engines": {

27 "node": ">=20.11"

28 },

29 "keywords": [

30 "codex",

31 "codexhost",

32 "theme",

33 "dream-skin",

34 "windows"

35 ],

36 "author": "alleyf",

37 "license": "MIT",

38 "repository": {

39 "type": "git",

uninstall.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2// uninstall.mjs - reverse of install.mjs.

3//

4// node uninstall.mjs

5//

6// 1. strips the codexhost bin/renderer patches back to stock (anchor-safe,

7// refuses to touch files whose layout it does not recognize)

8// 2. removes the PATH shim and the optional startup entry

9// 3. removes the runtime home %LOCALAPPDATA%\CodexSkinHub

10//

11// The Dream Skin installation, the theme library and Codex itself are left

install.mjsView file

Lines 93-133javascript

93const hubState = join(HUB_ROOT, "codexskin.json");

94if (legacyState && existsSync(legacyState) && !existsSync(hubState)) {

95 writeFileSync(hubState,

src/patch.mjsView file

Lines 95-135javascript

95

96// ---------------------------------------------------------------------------

97// Patch A - bin/codexhost.js

98// A1: hook import + `theme` subcommand dispatch (before startupTrace entry)

99// A2: superviseDetached() on launch

100// A3: --help extension (best effort, never fatal)

101// ---------------------------------------------------------------------------

102function binBlock1(eol) {

103

src/cli.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// codexskin - fuses BytePioneer-AI/codex-host with Fei-Away/Codex-Dream-Skin.

3//

4// codexskin start [--theme <name>] start codexhost + auto-inject + self-healing supervisor

5// codexskin theme [<name>] switch theme live (no Codex restart) / list themes

6// codexskin status show endpoint / injector / theme state

7// codexskin down stop codexhost supervisor and the theme injector

8//

9// How it works:

10// - Dream Skin themes are injected at runtime over CDP. The injector watch loop

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.2.1 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg

src/hook.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.2.1 matchedPath = src/hook.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hook.mjsView on unpkg