Loading npm security reports…

devcodex@1.16.5: AI-agent control-surface risk | LPM Firewall

registry / devcodex / 1.16.5

devcodex@1.16.5

DevCodex — AI-powered development workflow rules for Copilot, Claude Code, Codex, Gemini CLI and Grok

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically mutates several foreign AI-agent user control surfaces. The postinstall deploys package-controlled hooks, instructions, MCP servers, skills, and a Grok plugin.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g devcodex

Impact

Persistent package-controlled behavior can be activated in Copilot, Claude, Codex, Gemini, and Grok user sessions.

Mechanism

postinstall-driven multi-host global agent configuration deployment

Policy narrative

On global installation, postinstall calls applyGlobalHostConfig without interactive consent or host selection. That routine resolves user-level directories for five AI-agent products and deploys DevCodex instructions, hooks, MCP configuration, runtime files, skills, and a Grok plugin. These changes alter broad foreign agent control surfaces automatically and persist beyond the npm command.

Rationale

The global-install lifecycle path is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces. Guardrails and lack of observed network activity do not remove that policy violation.

Evidence

package.jsonscripts/postinstall.jsscripts/lib/npm-lifecycle-adapter.jsscripts/lib/global-host-config.jsscripts/lib/global-host-target.jsscripts/lib/global-host-config-transaction.js~/.copilot~/.claude~/.codex

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

8L9: const fs = require('fs') L10: const os = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L8

scripts/lib/global-host-config.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L177: addInstructionRoot(operations, target.host, packageRoot, path.join(runtime, 'instructions.full.md'), fsImpl) L178: addSourceFile(operations, target.host, path.join(packageRoot, 'host-projections', 'AGENTS.md'), path.join(runtime, 'AGENTS.md'), fsImpl) L179: addSourceTree(operations, target.host, path.join(packageRoot, 'hooks', '_runtime'), path.join(runtime, 'hooks', '_runtime'), fsImpl) ... L254: * Map global host id → memory/profile agent identity (VALID_AGENTS). L255: * Claude host root is `.claude` but agent id is `claude-code`. L256: */ ... L264: L265: function buildMcpServers(runtimeRoot, options = {}) { L266: const agent = hostToRuntimeAgent(options.agent || options.host) ... L285: L286: function buildCop

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/lib/global-host-config.jsView on unpkg · L1

hooks/_runtime/stdio-bounds.cjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/_runtime/stdio-bounds.cjsView on unpkg

scripts/probe-skill-route-s15-host.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = scripts/probe-sk[redacted] matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/probe-skill-route-s15-host.jsView on unpkg

scripts/test-runtime-rolling-upgrade.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = scripts/test-runtime-rolling-upgrade.js matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-runtime-rolling-upgrade.jsView on unpkg

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView on unpkg

scripts/lib/global-host-runtime-verifier.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = scripts/lib/global-host-runtime-verifier.js matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/global-host-runtime-verifier.jsView on unpkg

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "devcodex",

3 "version": "1.16.5",

4 "description": "DevCodex — AI-powered development workflow rules for Copilot, Claude Code, Codex, Gemini CLI and Grok",

5 "main": "index.js",

6 "bin": {

7 "devcodex": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "global-adapters:apply": "node index.js global-adapters apply",

12 "global-adapters:apply:dry-run": "node index.js global-adapters apply --dry-run",

13 "test:global-adapters-cli": "node scripts/test-global-adapters-cli.js",

14 "test": "node scripts/run-validation.js --route full",

15 "test:fast": "node scripts/run-validation.js --route fast",

16 "test:full": "node scripts/run-validation.js --route full",

17 "test:all": "npm test",

18 "test:core": "node scripts/validate-versions.js && node scripts/validate.js",

19 "test:all:with-audit": "npm run test:all && npm run test:audit",

20 "test:audit": "node scripts/test-security-audit.js --registry=https://registry.npmjs.org",

21 "test:audit-runner": "node scripts/test-security-audit-runner.js",

22 "test:cli-behavior": "node scripts/test-cli-behavior.js",

23 "test:init": "node index.js init --dry-run",

24 "test:hooks-runtime": "node scripts/test-hooks-runtime.js",

25 "test:migrate-layout": "node scripts/test-migrate-layout.js",

26 "test:client-contracts": "node scripts/test-client-contracts.js",

27 "test:version": "node scripts/validate-versions.js",

28 "test:pack-clean": "node scripts/test-pack-clean.js",

29 "test:profile-governance": "node scripts/test-validate-profile.js",

30 "test:profile-all": "node scripts/validate-all-profiles.js",

index.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * DevCodex CLI – npx devcodex <command>

4 * Commands and aliases are defined by the shared CLI command registry.

5 */

6

7'use strict'

8

9const fs = require('fs')

scripts/lib/global-host-config.jsView file

Lines 1-21javascript

1'use strict'

2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/lib/global-host-config.jsView on unpkg · L1

3const crypto = require('crypto')

4const fs = require

hooks/_runtime/stdio-bounds.cjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/_runtime/stdio-bounds.cjsView on unpkg

scripts/probe-skill-route-s15-host.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = scripts/probe-sk[redacted] matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/probe-skill-route-s15-host.jsView on unpkg

scripts/test-runtime-rolling-upgrade.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = scripts/test-runtime-rolling-upgrade.js matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-runtime-rolling-upgrade.jsView on unpkg

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView on unpkg

scripts/lib/global-host-runtime-verifier.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = scripts/lib/global-host-runtime-verifier.js matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/global-host-runtime-verifier.jsView on unpkg

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.4 matchedPath = grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.16.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView on unpkg