Loading npm security reports…

codexskin-hub@0.3.3: Malicious npm security report (Block) | LPM Firewall

registry / codexskin-hub / 0.3.3

codexskin-hub@0.3.3

Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Npm postinstall installs a runtime copy and, when the companion engine is present, alters a separately installed Codex host package. The altered host imports this package at future launches and can start its detached supervisor.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm on a system with the Dream Skin engine present.

Impact

Changes future behavior of a global Codex host CLI and its renderer outside the consumer package.

Mechanism

Automatic patching of a foreign AI-agent CLI to load package-controlled code.

Attack narrative

Installing the package runs install.mjs automatically. It copies package code into a per-user runtime location and invokes a patcher if the Dream Skin engine exists. That patcher discovers the separately installed global @codexhost/cli, modifies its executable and renderer, and embeds a dynamic import of the package-controlled hook. The modified host can then launch a detached supervisor on later host invocations. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The lifecycle hook automatically modifies a separately installed global Codex host package and causes it to import package-controlled code later. That concrete foreign control-surface mutation meets the blocking install-hook policy despite the absence of observed secret theft.

Evidence

package.jsoninstall.mjssrc/patch.mjssrcuninstall.mjsbin/codexhost.jsapp/renderer-extension.jssrc/hook.mjs

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

uninstall.mjsView file

18import { fileURLToPath } from "node:url"; L19: import { spawnSync } from "node:child_process"; L20: import { platform as osPlatform } from "node:os";

High

Child Process

Package source references child process execution.

uninstall.mjsView on unpkg · L18

src/discover.mjsView file

22const r = spawnSync("npm", ["prefix", "-g"], { L23: encoding: "utf8", timeout: 15000, windowsHide: true, shell: true, L24: });

High

Shell

Package source references shell execution.

src/discover.mjsView on unpkg · L22

src/patch.mjsView file

107try { L108: dreamSkinHook = await import(pathToFileURL(dreamSkinHookPath).href); L109: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/patch.mjsView on unpkg · L107

install.mjsView file

25Trigger-reachable persistence chain: scripts.postinstall -> install.mjs L25: import { fileURLToPath } from "node:url"; L26: import { spawnSync } from "node:child_process"; L27: // Single source of truth for platform logic (data home, DS root candidates, ... L33: const repo = dirname(fileURLToPath(import.meta.url)); L34: const IS_WIN = process.platform === "win32"; L35: ... L133: try { L134: spawnSync("launchctl", ["load", STARTUP], { stdio: "ignore" }); L135: } catch { /* best effort - loads at next login anyway */ }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

install.mjsView on unpkg · L25

25import { fileURLToPath } from "node:url"; L26: import { spawnSync } from "node:child_process"; L27: // Single source of truth for platform logic (data home, DS root candidates, ... L33: const repo = dirname(fileURLToPath(import.meta.url)); L34: const IS_WIN = process.platform === "win32"; L35: ... L133: try { L134: spawnSync("launchctl", ["load", STARTUP], { stdio: "ignore" }); L135: } catch { /* best effort - loads at next login anyway */ }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

install.mjsView on unpkg · L25

src/cli.mjsView file

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/cli.mjsView on unpkg · L19

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L47: try { L48: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L49: } catch {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/cli.mjsView on unpkg · L19

19Trigger-reachable chain: manifest.bin -> src/cli.mjs L19: // Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L47: try { L48: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L49: } catch {

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.3.0 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "codexskin-hub",

3 "version": "0.3.3",

4 "description": "Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host",

5 "type": "module",

6 "bin": {

7 "codexskin": "src/cli.mjs"

8 },

9 "files": [

10 "src",

11 "install.mjs",

12 "uninstall.mjs",

13 "README.md"

14 ],

15 "os": [

16 "win32",

17 "darwin"

18 ],

19 "scripts": {

20 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "uninstall": "node uninstall.mjs",

22 "doctor": "node src/cli.mjs doctor",

23 "patch": "node src/patch.mjs",

24 "status": "node src/patch.mjs status",

25 "revert": "node src/patch.mjs --revert"

26 },

27 "engines": {

28 "node": ">=20.11"

29 },

30 "keywords": [

31 "codex",

32 "codexhost",

33 "theme",

34 "dream-skin",

35 "windows",

36 "macos"

37 ],

38 "author": "alleyf",

39 "license": "MIT",

40 "repository": {

uninstall.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// uninstall.mjs - reverse of install.mjs.

3//

4// node uninstall.mjs

5//

6// 1. strips the codexhost bin/renderer patches back to stock (anchor-safe,

7// refuses to touch files whose layout it does not recognize)

8// 2. removes the PATH shim and the optional startup entry

9// 3. removes the runtime home (per-OS: %LOCALAPPDATA%\CodexSkinHub,

10// ~/Library/Application Support/CodexSkinHub, XDG data home)

11

src/discover.mjsView file

Lines 2-42javascript

2// single npm prefix (issue #2: nvm-windows and custom `npm config set prefix`

3// layouts keep global packages outside %APPDATA%\npm). No side effects on

4// import - both cli.mjs and patch.mjs share this helper.

5import { existsSync, readFileSync } from "node:fs";

6import { join } from "node:path";

7import { spawnSync } from

src/patch.mjsView file

Lines 87-127javascript

87

88// ---------------------------------------------------------------------------

89// Patch A - bin/codexhost.js

90// A1: hook import + `theme` subcommand dispatch (before startupTrace entry)

91// A2: superviseDetached() on launch

92// A3: --help extension (best effort, never fatal)

93// ---------------------------------------------------------------------------

94function binBlock1(eol, hookCandidates) {

install.mjsView file

Lines 5-45javascript

5// node install.mjs --startup # also register a per-user startup entry

6//

7// What it does:

8// 1. copies src/ to the runtime home %LOCALAPPDATA%\CodexSkinHub\src

9// (the repo itself can be moved or deleted afterwards)

10// 2. writes config.json pointing at the Dream Skin engine root

11// 3. migrates codexskin.json (active theme state) from the legacy

12// CodexDreamSkin directory when present

13// 4. applies the codexhost bin/renderer patches (idempotent, anchor-safe)

14// 5. writes the PATH shim %USERPROFILE%\.local\bin\codexskin.cmd

src/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// codexskin - fuses BytePioneer-AI/codex-host with Fei-Away/Codex-Dream-Skin.

3//

4// codexskin start [--theme <name>] start codexhost + auto-inject + self-healing supervisor

5// codexskin theme [<name>] switch theme live (no Codex restart) / list themes

6// codexskin status show endpoint / injector / theme state

7// codexskin down stop codexhost supervisor and the theme injector

8//

9// How it works:

10// - Dream Skin themes are injected at runtime over CDP. The injector watch loop

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.3.0 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg