Loading npm security reports…

codexskin-hub@0.4.5: AI-agent control-surface risk | LPM Firewall

registry / codexskin-hub / 0.4.5

codexskin-hub@0.4.5

Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Npm postinstall patches a foreign Codex host package, modifying both its launcher and renderer. The injected launcher loads this package's hook and silently repairs the modifications on later host launches.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package while the Dream Skin engine is present; later launches of the patched host.

Impact

Changes the control path and UI of a separately installed AI host without an explicit user command.

Mechanism

Automatic foreign host patching with a self-healing detached hook.

Policy narrative

During npm postinstall, the package copies itself to a runtime directory and invokes a patcher. That patcher modifies a separately installed @codexhost/cli launcher and renderer extension, making the host import the package hook and embed its UI payload. On subsequent host launches, the hook starts a detached repair process that re-applies the patches. This is unconsented persistence in a foreign AI-agent control surface.

AI rationale

The automatic lifecycle chain mutates a foreign AI host and installs a detached self-healing mechanism. This is concrete install-hook abuse even though no credential theft was found.

Evidence

package.jsoninstall.mjssrc/patch.mjssrc/hook.mjssrc/payload/renderer.js@codexhost/cli/bin/codexhost.js@codexhost/cli/node_modules/@codexhost/*/app/renderer-extension.jsCodexSkinHub/src/hook.mjs

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

uninstall.mjsView file

18import { fileURLToPath } from "node:url"; L19: import { spawnSync } from "node:child_process"; L20: import { platform as osPlatform } from "node:os";

High

Child Process

Package source references child process execution.

uninstall.mjsView on unpkg · L18

src/discover.mjsView file

22const r = spawnSync("npm", ["prefix", "-g"], { L23: encoding: "utf8", timeout: 15000, windowsHide: true, shell: true, L24: });

High

Shell

Package source references shell execution.

src/discover.mjsView on unpkg · L22

src/patch.mjsView file

107try { L108: dreamSkinHook = await import(pathToFileURL(dreamSkinHookPath).href); L109: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/patch.mjsView on unpkg · L107

install.mjsView file

24Trigger-reachable persistence chain: scripts.postinstall -> install.mjs L24: import { fileURLToPath } from "node:url"; L25: import { spawnSync, spawn } from "node:child_process"; L26: // Single source of truth for platform logic (data home, DS root candidates, ... L32: const repo = dirname(fileURLToPath(import.meta.url)); L33: const IS_WIN = process.platform === "win32"; L34: ... L68: let pid = 0; L69: try { pid = Number(JSON.parse(readFileSync(statePath, "utf8").replace(/^\uFEFF/, "")).supervisePid) || 0; } catch { return 0; } L70: if (!pid) return 0; ... L121: if (copied) { L122: for (const f of ["install.mjs", "uninstall.mjs", "package.json"]) { L123: if (existsSync(join(repo, f))) cpSync(join(repo, f), join(HUB_ROOT, f));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

install.mjsView on unpkg · L24

24import { fileURLToPath } from "node:url"; L25: import { spawnSync, spawn } from "node:child_process"; L26: // Single source of truth for platform logic (data home, DS root candidates, ... L32: const repo = dirname(fileURLToPath(import.meta.url)); L33: const IS_WIN = process.platform === "win32"; L34: ... L68: let pid = 0; L69: try { pid = Number(JSON.parse(readFileSync(statePath, "utf8").replace(/^\uFEFF/, "")).supervisePid) || 0; } catch { return 0; } L70: if (!pid) return 0; ... L121: if (copied) { L122: for (const f of ["install.mjs", "uninstall.mjs", "package.json"]) { L123: if (existsSync(join(repo, f))) cpSync(join(repo, f), join(HUB_ROOT, f));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

install.mjsView on unpkg · L24

src/cli.mjsView file

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/cli.mjsView on unpkg · L19

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L48: try { L49: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L50: } catch {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/cli.mjsView on unpkg · L19

19Trigger-reachable chain: manifest.bin -> src/cli.mjs L19: // Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L48: try { L49: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L50: } catch {

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.3.3 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.3.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "codexskin-hub",

3 "version": "0.4.5",

4 "description": "Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host",

5 "type": "module",

6 "bin": {

7 "codexskin": "src/cli.mjs"

8 },

9 "files": [

10 "src",

11 "install.mjs",

12 "uninstall.mjs",

13 "README.md"

14 ],

15 "os": [

16 "win32",

17 "darwin"

18 ],

19 "scripts": {

20 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "uninstall": "node uninstall.mjs",

22 "doctor": "node src/cli.mjs doctor",

23 "patch": "node src/patch.mjs",

24 "status": "node src/patch.mjs status",

25 "revert": "node src/patch.mjs --revert"

26 },

27 "engines": {

28 "node": ">=20.11"

29 },

30 "keywords": [

31 "codex",

32 "codexhost",

33 "theme",

34 "dream-skin",

35 "windows",

36 "macos"

37 ],

38 "author": "alleyf",

39 "license": "MIT",

40 "repository": {

uninstall.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// uninstall.mjs - reverse of install.mjs.

3//

4// node uninstall.mjs

5//

6// 1. strips the codexhost bin/renderer patches back to stock (anchor-safe,

7// refuses to touch files whose layout it does not recognize)

8// 2. removes the PATH shim and the optional startup entry

9// 3. removes the runtime home (per-OS: %LOCALAPPDATA%\CodexSkinHub,

10// ~/Library/Application Support/CodexSkinHub, XDG data home)

11

src/discover.mjsView file

Lines 2-42javascript

2// single npm prefix (issue #2: nvm-windows and custom `npm config set prefix`

3// layouts keep global packages outside %APPDATA%\npm). No side effects on

4// import - both cli.mjs and patch.mjs share this helper.

5import { existsSync, readFileSync } from "node:fs";

6import { join } from "node:path";

7import { spawnSync } from

src/patch.mjsView file

Lines 87-127javascript

87

88// ---------------------------------------------------------------------------

89// Patch A - bin/codexhost.js

90// A1: hook import + `theme` subcommand dispatch (before startupTrace entry)

91// A2: superviseDetached() on launch

92// A3: --help extension (best effort, never fatal)

93// ---------------------------------------------------------------------------

94function binBlock1(eol, hookCandidates) {

install.mjsView file

Lines 4-44javascript

4// node install.mjs # install / upgrade (idempotent)

5// node install.mjs --startup # also register a per-user startup entry

6//

7// What it does:

8// 1. copies src/ to the runtime home %LOCALAPPDATA%\CodexSkinHub\src

9// (the repo itself can be moved or deleted afterwards)

10// 2. writes config.json pointing at the Dream Skin engine root

11// 3. migrates codexskin.json (active theme state) from the legacy

12// CodexDreamSkin directory when present

13// 4. applies the codexhost bin/renderer patches (idempotent, anchor-safe)

src/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// codexskin - fuses BytePioneer-AI/codex-host with Fei-Away/Codex-Dream-Skin.

3//

4// codexskin start [--theme <name>] start codexhost + auto-inject + self-healing supervisor

5// codexskin theme [<name>] switch theme live (no Codex restart) / list themes

6// codexskin status show endpoint / injector / theme state

7// codexskin down stop codexhost supervisor and the theme injector

8//

9// How it works:

10// - Dream Skin themes are injected at runtime over CDP. The injector watch loop

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.3.3 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.3.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg