registry / create-egregore / 0.19.5

create-egregore@0.19.5

Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code or Codex.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit CLI setup installs a first-party Egregore Codex runtime into an Egregore project. It adds agent instructions, skills, and a hook; telemetry is separately opt-out capable.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `create-egregore` and selects or upgrades an Egregore/Codex setup.

Impact

Changes the selected project’s AI-agent configuration and may send consent-controlled product telemetry.

Mechanism

User-invoked first-party AI-agent runtime installation and optional API telemetry.

Rationale

Static hints correctly identified network, shell, and agent-runtime primitives, but source ties them to explicit setup and GitHub/Egregore product flows. The package warrants a warning for agent-runtime installation risk, not a block.

Evidence

package.jsonbin/cli.jslib/auth.jslib/codex-runtime.jsruntime/codex/manifest.jsonruntime/codex/bin/telemetry.sh.codex/config.toml.codex/hooks.json.codex/hooks/branch-guard.js.codex/skillsAGENTS.md.agents/skills$HOME/.egregore/telemetry.jsonl

Network endpoints3

egregore-production-55f2.up.railway.appapi.github.comgithub.com/login/device

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`lib/codex-runtime.js` copies bundled files into target projects, including `.codex/config.toml`, hooks, skills, and `AGENTS.md`.
`lib/codex-runtime.js` creates `.agents/skills` symlink to `.codex/skills`.
`runtime/codex/bin/telemetry.sh` can buffer and send telemetry to the Egregore Railway API.
`lib/auth.js` can install `gh` through a user-visible interactive command.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or other lifecycle hook.
The installer executes only through the explicit `create-egregore` CLI entrypoint.
GitHub and Egregore API calls implement requested setup, authentication, repository, invitation, and notification flows.
No source evidence of arbitrary remote payload execution, credential exfiltration to an unrelated endpoint, or destructive behavior.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 358 KB of source, external domains: cli.github.com, egregore-production-55f2.up.railway.app, git-scm.com, github.com, nodejs.org, stedolan.github.io, t.me, xgksfrirtdumacvmfkzj.supabase.co

Source & flagged code

9 flagged

lib/local.jsView file

Lines 1160-1200javascript

1160 } else {

1161 s3.fail(`${newProjectRepo} creation timed out`);

1162 }

1163 } catch (err) {

1164 s3.fail(`Could not create ${newProjectRepo}: ${err.message}`);

1165 }

1166 }

1167 }

1168

1169 // 8. Write egregore.json to remote repo (so joiners can read it)

1170 const egreConfig = {

1171 mode: "local",

1172 org_name: orgName,

1173 github_org: githubOrg,

1174 memory_repo: `https://github.com/${githubOrg}/${memoryRepoName}.git`,

1175 slug: slug,

1176 repo_name: repoName,

1177 repos: selectedRepos,

1178 upstream_url: "https://github.com/egregore-labs/egregore.git",

1179 report_url: "https://xgksfrirtdumacvmfkzj.supabase.co",

1180 report_key: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Inhna3NmcmlydGR1bWFjdm1ma3pqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzA5OTA1ODksImV4cCI6MjA4NjU2NjU4OX0.1UWNgER6nQazrayly1KDrswClURUkGKxeirZg5L8uk4",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/local.jsView on unpkg · L1180

Critical

Secret Pattern

Supabase service role key (JWT) in lib/local.js

lib/local.jsView on unpkg · L1180

1181 };

1182 // Joiners resolve the org by reading egregore.json from the remote — if

1183 // this push silently fails (observed: transient failure right after

1184 // template generation), the org is unjoinable and the founder never knows.

1185 const configPushed = await retryAsync(async () => {

1186 const { status } = await putFileContent(

1187 githubToken,

1188 githubOrg,

1189 repoName,

1190 "egregore.json",

1191 JSON.stringify(egreConfig, null, 2) + "\n",

1192 `Configure egregore for ${orgName}`,

1193 );

1194 return status < 300;

1195 });

1196 if (!configPushed) {

1197 ui.warn(`Could not publish egregore.json to ${githubOrg}/${repoName} — teammates can't join until it's there.`);

1198 ui.info(` Re-run this installer to retry, or push egregore.json from the cloned repo.`);

1199 }

1200

bin/cli.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * create-egregore — set up Egregore for your team in one command.

5 *

6 * - Installs an `egregore` PATH binary instead of a shell alias

7 * - Auto-execs into the selected assistant (Claude Code or Codex) at the end

8 *

9 * Four modes:

10 * npx -y create-egregore@latest --token st_xxxx (from website)

11 * npx -y create-egregore@latest (guided setup / launcher)

lib/setup.jsView file

Lines 1-22javascript

1/**

2 * Local setup — clone, symlink, alias, .env.

3 * Zero dependencies — uses node:child_process, node:fs, node:path, node:os.

4 */

6const { execSync, execFileSync, spawnSync, spawn } = require("node:child_process");

7const fs = require

lib/auth.jsView file

Lines 1-52javascript

1/**

2 * GitHub Device Flow authentication.

3 * Zero dependencies — uses node:https built-in.

4 */

6const https = require("node:https");

7const { spawnSync } = require("node:child_process");

runtime/codex/bin/publish-artifact.shView file

•path = runtime/codex/bin/publish-artifact.sh kind = build_helper sizeBytes = 7585 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/codex/bin/publish-artifact.shView on unpkg

assets/egregore-launcher.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = create-egregore@0.19.3 matchedIdentity = npm:Y3JlYXRlLWVncmVnb3Jl:0.19.3 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

assets/egregore-launcher.jsView on unpkg

Source & flagged code

9 flagged · loading source

lib/local.jsView file

1180patternName = supabase_service_key severity = critical line = 1180 matchedText = report_k...k4",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/local.jsView on unpkg · L1180

1180patternName = supabase_service_key severity = critical line = 1180 matchedText = report_k...k4",

Critical

Secret Pattern

Supabase service role key (JWT) in lib/local.js

lib/local.jsView on unpkg · L1180

bin/cli.jsView file

17const path = require("node:path"); L18: const { spawnSync } = require("node:child_process"); L19: const ui = require("../lib/ui");

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L17

lib/setup.jsView file

490L491: // Warm the npx cache for egregore-artifacts so the first /view or L492: // publish-artifact call doesn't pay a cold npm download (~5-10s). ... L496: try { L497: const { spawn } = require("child_process"); L498: const warm = spawn("npx", ["-y", "egregore-artifacts@latest", "--help"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/setup.jsView on unpkg · L490

2* Local setup — clone, symlink, alias, .env. L3: * Zero dependencies — uses node:child_process, node:fs, node:path, node:os. L4: */ ... L15: L16: const https = require("node:https"); L17: ... L45: try { L46: resolve({ status: res.statusCode, data: JSON.parse(buf) }); L47: } catch { ... L314: const { fork_url, memory_url, github_token, org_name, github_org, slug, api_key, repos = [], telegram_group_link, github_username, github_name } = data; L315: const base = targetDir || process.cwd(); L316: const skipRepos = opts.skipRepos instanceof Set ? opts.skipRepos : new Set();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/setup.jsView on unpkg · L2

lib/auth.jsView file

32function ghCliExists() { L33: if (process.env.EGREGORE_SKIP_GH === "1") return false; L34: const which = spawnSync("which", ["gh"], { stdio: "pipe" }); L35: return which.status === 0; ... L42: // Canonical, cross-platform install page — always correct regardless of OS. L43: const GH_INSTALL_URL = "https://cli.github.com"; L44:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/auth.jsView on unpkg · L32

5L6: const https = require("node:https"); L7: const { spawnSync } = require("node:child_process"); L8: ... L21: function envGhAuth() { L22: const envToken = (process.env.EGREGORE_GITHUB_TOKEN || "").trim(); L23: if (!envToken) return null; ... L38: function canUseInteractiveBrowserFlow() { L39: return !!(process.stdin.isTTY && process.stdout.isTTY); L40: } ... L55: function isHeadless() { L56: if (process.platform === "darwin" || process.platform === "win32") return false;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/auth.jsView on unpkg · L5

runtime/codex/bin/publish-artifact.shView file

•path = runtime/codex/bin/publish-artifact.sh kind = build_helper sizeBytes = 7585 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/codex/bin/publish-artifact.shView on unpkg

assets/egregore-launcher.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

assets/egregore-launcher.jsView on unpkg

Findings

3 Critical5 High5 Medium4 Low

CriticalCritical Secretlib/local.js

CriticalPrevious Version Dangerous Deltaassets/egregore-launcher.js

CriticalSecret Patternlib/local.js

HighChild Processbin/cli.js

HighShell

HighSame File Env Network Executionlib/auth.js

HighSandbox Evasion Gated Capabilitylib/auth.js

HighRuntime Package Installlib/setup.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/setup.js

MediumShips Build Helperruntime/codex/bin/publish-artifact.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

lib/local.jsView file

Lines 1160-1200javascript

1160 } else {

1161 s3.fail(`${newProjectRepo} creation timed out`);

1162 }

1163 } catch (err) {

1164 s3.fail(`Could not create ${newProjectRepo}: ${err.message}`);

1165 }

1166 }

1167 }

1168

1169 // 8. Write egregore.json to remote repo (so joiners can read it)

1170 const egreConfig = {

1171 mode: "local",

1172 org_name: orgName,

1173 github_org: githubOrg,

1174 memory_repo: `https://github.com/${githubOrg}/${memoryRepoName}.git`,

1175 slug: slug,

1176 repo_name: repoName,

1177 repos: selectedRepos,

1178 upstream_url: "https://github.com/egregore-labs/egregore.git",

1179 report_url: "https://xgksfrirtdumacvmfkzj.supabase.co",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/local.jsView on unpkg · L1180

Critical

Secret Pattern

Supabase service role key (JWT) in lib/local.js

lib/local.jsView on unpkg · L1180

1181 };

1182 // Joiners resolve the org by reading egregore.json from the remote — if

1183 // this push silently fails (observed: transient failure right after

1184 // template generation), the org is unjoinable and the founder never knows.

1185 const configPushed = await retryAsync(async () => {

1186 const { status } = await putFileContent(

1187 githubToken,

1188 githubOrg,

1189 repoName,

1190 "egregore.json",

1191 JSON.stringify(egreConfig, null, 2) + "\n",

1192 `Configure egregore for ${orgName}`,

1193 );

1194 return status < 300;

1195 });

1196 if (!configPushed) {

1197 ui.warn(`Could not publish egregore.json to ${githubOrg}/${repoName} — teammates can't join until it's there.`);

1198 ui.info(` Re-run this installer to retry, or push egregore.json from the cloned repo.`);

1199 }

1200

bin/cli.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * create-egregore — set up Egregore for your team in one command.

5 *

6 * - Installs an `egregore` PATH binary instead of a shell alias

7 * - Auto-execs into the selected assistant (Claude Code or Codex) at the end

8 *

9 * Four modes:

10 * npx -y create-egregore@latest --token st_xxxx (from website)

11 * npx -y create-egregore@latest (guided setup / launcher)

lib/setup.jsView file

Lines 1-22javascript

1/**

2 * Local setup — clone, symlink, alias, .env.

3 * Zero dependencies — uses node:child_process, node:fs, node:path, node:os.

4 */

6const { execSync, execFileSync, spawnSync, spawn } = require("node:child_process");

7const fs = require

lib/auth.jsView file

Lines 1-52javascript

1/**

2 * GitHub Device Flow authentication.

3 * Zero dependencies — uses node:https built-in.

4 */

6const https = require("node:https");

7const { spawnSync } = require("node:child_process");

runtime/codex/bin/publish-artifact.shView file

•path = runtime/codex/bin/publish-artifact.sh kind = build_helper sizeBytes = 7585 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/codex/bin/publish-artifact.shView on unpkg

assets/egregore-launcher.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

assets/egregore-launcher.jsView on unpkg