Loading npm security reports…

codexskin-hub@0.3.0: AI-agent control-surface risk | LPM Firewall

registry / codexskin-hub / 0.3.0

codexskin-hub@0.3.0

Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation modifies the separate @codexhost/cli launcher and renderer to load package code. The injected code can run a detached supervisor against Codex Desktop's local debugging interface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs postinstall when the Dream Skin engine is present; later codexhost launches invoke the injected hook.

Impact

A package silently changes another AI application command and renderer so its code runs on later launches and can evaluate its restricted theme bridge in Codex Desktop pages.

Mechanism

Install-time foreign launcher and renderer patching with a detached CDP supervisor.

Policy narrative

Installing the package invokes install.mjs. When its engine probe succeeds, the installer runs a patcher that changes the separately installed @codexhost/cli binary and renderer. The inserted launcher code dynamically imports codexskin's hook on future codexhost launches. That hook can launch a detached supervisor, which connects to Codex Desktop's local CDP endpoint and evaluates bridge commands in app pages. This is unconsented postinstall modification of a foreign AI-agent control surface.

AI rationale

The package implements a complete automatic lifecycle chain that patches a foreign Codex host executable and causes its own detached code to run later. This meets the install-control-surface block policy despite no confirmed external exfiltration.

Evidence

package.jsoninstall.mjssrc/patch.mjssrc/hook.mjs@codexhost/cli/bin/codexhost.js@codexhost/cli/node_modules/@codexhost/cli-*/app/renderer-extension.js

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

uninstall.mjsView file

17import { fileURLToPath } from "node:url"; L18: import { spawnSync } from "node:child_process"; L19: import { homedir } from "node:os";

High

Child Process

Package source references child process execution.

uninstall.mjsView on unpkg · L17

install.mjsView file

20import { L21: accessSync, chmodSync, constants, cpSync, existsSync, mkdirSync, L22: readFileSync, writeFileSync, rmSync, L23: } from "node:fs"; ... L65: ? join(process.env.APPDATA ?? join(homedir(), "AppData", "Roaming"), "Microsoft", "Windows", "Start Menu", "Programs", "Startup", "CodexSkinHub.cmd") L66: : join(homedir(), "Library", "LaunchAgents", "cc.dreamskin.codexskin.plist"); L67: const withStartup = process.argv.includes("--startup"); ... L102: } L103: mkdirSync(join(HUB_ROOT, "src"), { recursive: true }); L104: rmSync(join(HUB_ROOT, "src"), { recursive: true, force: true }); L105: cpSync(join(repo, "src"), join(HUB_ROOT, "src"), { recursive: true }); L106: for (const f of ["install.mjs", "uninstall.mjs"]) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L20

140L141: // 5. PATH shim (pure ASCII - see GBK/PowerShell 5.1 encoding lessons). L142: // Windows: codexskin.cmd batch wrapper. macOS/Linux: POSIX sh script with

High

Shell

Package source references shell execution.

install.mjsView on unpkg · L140

25Trigger-reachable persistence chain: scripts.postinstall -> install.mjs L25: import { fileURLToPath } from "node:url"; L26: import { spawnSync } from "node:child_process"; L27: import { homedir } from "node:os"; ... L29: const repo = dirname(fileURLToPath(import.meta.url)); L30: const IS_WIN = process.platform === "win32"; L31: ... L34: function dataHome() { L35: if (IS_WIN) return process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"); L36: if (process.platform === "darwin") return join(homedir(), "Library", "Application Support"); ... L162: [ L163: "#!/bin/sh", L164: `CSHUB_NODE="${engineNode}"`,

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/patch.mjsView file

107try { L108: dreamSkinHook = await import(pathToFileURL(dreamSkinHookPath).href); L109: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/patch.mjsView on unpkg · L107

src/cli.mjsView file

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/cli.mjsView on unpkg · L19

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L47: try { L48: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L49: } catch {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/cli.mjsView on unpkg · L19

19Trigger-reachable chain: manifest.bin -> src/cli.mjs L19: // Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L47: try { L48: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L49: } catch {

src/platform.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/platform.mjs#virtual:normalized:round1View on unpkg

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.2.2 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "codexskin-hub",

3 "version": "0.3.0",

4 "description": "Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host",

5 "type": "module",

6 "bin": {

7 "codexskin": "src/cli.mjs"

8 },

9 "files": [

10 "src",

11 "install.mjs",

12 "uninstall.mjs",

13 "README.md"

14 ],

15 "os": [

16 "win32",

17 "darwin"

18 ],

19 "scripts": {

20 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "uninstall": "node uninstall.mjs",

22 "doctor": "node src/cli.mjs doctor",

23 "patch": "node src/patch.mjs",

24 "status": "node src/patch.mjs status",

25 "revert": "node src/patch.mjs --revert"

26 },

27 "engines": {

28 "node": ">=20.11"

29 },

30 "keywords": [

31 "codex",

32 "codexhost",

33 "theme",

34 "dream-skin",

35 "windows"

36 ],

37 "author": "alleyf",

38 "license": "MIT",

39 "repository": {

40 "type": "git",

uninstall.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2// uninstall.mjs - reverse of install.mjs.

3//

4// node uninstall.mjs

5//

6// 1. strips the codexhost bin/renderer patches back to stock (anchor-safe,

7// refuses to touch files whose layout it does not recognize)

8// 2. removes the PATH shim and the optional startup entry

9// 3. removes the runtime home %LOCALAPPDATA%\CodexSkinHub

10//

11// The Dream Skin installation, the theme library and Codex itself are left

install.mjsView file

Lines 5-45javascript

5// node install.mjs --startup # also register a per-user startup entry

6//

7// What it does:

8// 1. copies src/ to the runtime home %LOCALAPPDATA%\CodexSkinHub\src

9// (the repo itself can be moved or deleted afterwards)

10// 2. writes config.json pointing at the Dream Skin engine root

11// 3. migrates codexskin.json (active theme state) from the legacy

12// CodexDreamSkin directory when present

13// 4. applies the codexhost bin/renderer patches (idempotent, anchor-safe)

14// 5. writes the PATH shim %USERPROFILE%\.local\bin\codexskin.cmd

src/patch.mjsView file

Lines 87-127javascript

87

88// ---------------------------------------------------------------------------

89// Patch A - bin/codexhost.js

90// A1: hook import + `theme` subcommand dispatch (before startupTrace entry)

91// A2: superviseDetached() on launch

92// A3: --help extension (best effort, never fatal)

93// ---------------------------------------------------------------------------

94function binBlock1(eol, hookCandidates) {

src/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// codexskin - fuses BytePioneer-AI/codex-host with Fei-Away/Codex-Dream-Skin.

3//

4// codexskin start [--theme <name>] start codexhost + auto-inject + self-healing supervisor

5// codexskin theme [<name>] switch theme live (no Codex restart) / list themes

6// codexskin status show endpoint / injector / theme state

7// codexskin down stop codexhost supervisor and the theme injector

8//

9// How it works:

10// - Dream Skin themes are injected at runtime over CDP. The injector watch loop

src/platform.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/platform.mjs#virtual:normalized:round1View on unpkg

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.2.2 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg