Loading npm security reports…

codexskin-hub@0.4.8: Malicious npm security report (Block) | LPM Firewall

registry / codexskin-hub / 0.4.8

codexskin-hub@0.4.8

Standalone Dream Skin theme management for codexhost-launched Codex: theme hot-switch, ZIP import, gallery, in-app settings page - non-invasive to Codex Dream Skin and codex-host

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Automatic installation modifies a separately installed Codex-hosting CLI and its renderer. The patch causes package code to load and supervise during later codexhost launches, with CDP code evaluation in application targets.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when a Dream Skin engine is detected; later normal codexhost launches.

Impact

A package install silently changes a foreign AI-agent control surface and arranges ongoing execution of package code.

Mechanism

Postinstall patch injection and detached CDP supervisor persistence.

Attack narrative

On postinstall, the package copies itself to a user runtime directory and, when its engine is present, runs a patcher against a separately installed @codexhost/cli. That patch injects a dynamic import of this package's hook and a detached supervisor call into the foreign CLI, and alters its renderer. The hook silently reapplies the patch after restoration and starts a detached supervisor. The supervisor then uses local CDP Runtime.evaluate against Codex application targets. This is unconsented install-time mutation and persistence in a foreign AI-agent control surface.

AI rationale

The automatic postinstall chain modifies another package's launcher and renderer, then makes the modification self-healing and persistent across normal launches. This meets the install-hook abuse policy even though secret theft was not established.

Evidence

package.jsoninstall.mjssrc/patch.mjssrc/hook.mjssrc/cli.mjssrc/config.json~/.local/bin/codexskin

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

uninstall.mjsView file

18import { fileURLToPath } from "node:url"; L19: import { spawnSync } from "node:child_process"; L20: import { platform as osPlatform } from "node:os";

High

Child Process

Package source references child process execution.

uninstall.mjsView on unpkg · L18

src/discover.mjsView file

22const r = spawnSync("npm", ["prefix", "-g"], { L23: encoding: "utf8", timeout: 15000, windowsHide: true, shell: true, L24: });

High

Shell

Package source references shell execution.

src/discover.mjsView on unpkg · L22

src/tools/check-payload-render.cjsView file

60// eslint-disable-next-line no-new-func L61: const factory = new Function(...names, `"use strict"; ${body}; return ${fnName}(...ARGS);`); L62: const call = factory.toString().replace("...ARGS", JSON.stringify(args).slice(1, -1));

High

Eval

Package source references dynamic code evaluation.

src/tools/check-payload-render.cjsView on unpkg · L60

src/patch.mjsView file

107try { L108: dreamSkinHook = await import(pathToFileURL(dreamSkinHookPath).href); L109: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/patch.mjsView on unpkg · L107

install.mjsView file

24Trigger-reachable persistence chain: scripts.postinstall -> install.mjs L24: import { fileURLToPath } from "node:url"; L25: import { spawnSync, spawn } from "node:child_process"; L26: // Single source of truth for platform logic (data home, DS root candidates, ... L32: const repo = dirname(fileURLToPath(import.meta.url)); L33: const IS_WIN = process.platform === "win32"; L34: ... L68: let pid = 0; L69: try { pid = Number(JSON.parse(readFileSync(statePath, "utf8").replace(/^\uFEFF/, "")).supervisePid) || 0; } catch { return 0; } L70: if (!pid) return 0; ... L121: if (copied) { L122: for (const f of ["install.mjs", "uninstall.mjs", "package.json"]) { L123: if (existsSync(join(repo, f))) cpSync(join(repo, f), join(HUB_ROOT, f));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

install.mjsView on unpkg · L24

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = install.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.mjsView on unpkg

24import { fileURLToPath } from "node:url"; L25: import { spawnSync, spawn } from "node:child_process"; L26: // Single source of truth for platform logic (data home, DS root candidates, ... L32: const repo = dirname(fileURLToPath(import.meta.url)); L33: const IS_WIN = process.platform === "win32"; L34: ... L68: let pid = 0; L69: try { pid = Number(JSON.parse(readFileSync(statePath, "utf8").replace(/^\uFEFF/, "")).supervisePid) || 0; } catch { return 0; } L70: if (!pid) return 0; ... L121: if (copied) { L122: for (const f of ["install.mjs", "uninstall.mjs", "package.json"]) { L123: if (existsSync(join(repo, f))) cpSync(join(repo, f), join(HUB_ROOT, f));

src/cli.mjsView file

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/cli.mjsView on unpkg · L19

19// Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L48: try { L49: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L50: } catch {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/cli.mjsView on unpkg · L19

19Trigger-reachable chain: manifest.bin -> src/cli.mjs L19: // Linux is hard-blocked because upstream Dream Skin has no Linux engine. L20: if (process.platform === "linux" && !process.env.CODEXSKIN_ALLOW_NON_WIN32) { L21: console.error("[codexskin] Linux is not supported: the upstream Codex Dream Skin"); ... L27: console.error("[codexskin] note: macOS support is experimental and untested on real hardware;"); L28: console.error(" report issues at https://github.com/Alleyf/CodexSkinHub/issues"); L29: } L30: L31: import { spawn, execFile, spawnSync } from "node:child_process"; L32: import fs from "node:fs"; ... L48: try { L49: return JSON.parse(fs.readFileSync(path.join(HUB_ROOT, "config.json"), "utf8")); L50: } catch {

src/hook.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/hook.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hook.mjsView on unpkg

src/platform.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/platform.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/platform.mjsView on unpkg

src/tools/ui-verify.mjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/tools/ui-verify.mjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/ui-verify.mjsView on unpkg

src/tools/probe-action.cjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/tools/probe-action.cjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/probe-action.cjsView on unpkg

src/tools/probe-bridge.cjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/tools/probe-bridge.cjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/probe-bridge.cjsView on unpkg

src/tools/probe-export-logs.cjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/tools/probe-export-logs.cjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/probe-export-logs.cjsView on unpkg

src/tools/probe-status.cjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/tools/probe-status.cjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/probe-status.cjsView on unpkg

src/tools/probe-targets.cjsView file

•matchType = normalized_sha256 matchedPackage = codexskin-hub@0.4.5 matchedPath = src/tools/probe-targets.cjs matchedIdentity = npm:Y29kZXhza2luLWh1Yg:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/probe-targets.cjsView on unpkg