Loading npm security reports…

devcodex@1.17.0: AI-agent control-surface risk | LPM Firewall

registry / devcodex / 1.17.0

devcodex@1.17.0

DevCodex — AI-powered development workflow rules for Copilot, Claude Code, Codex, Gemini CLI, Grok and Cursor

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically mutates multiple user-level AI-agent control surfaces. It installs hooks, instructions, MCP servers, runtime code, and plugins across unrelated hosts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g devcodex (postinstall)

Impact

Unconsented persistent control of Copilot, Claude, Codex, Gemini, Grok, and Cursor user configuration.

Mechanism

Automatic global AI-agent configuration and hook/MCP/plugin deployment

Policy narrative

The package’s postinstall runs automatically on global installation and calls its global host configuration routine. That routine targets six AI-agent products and writes user-home instructions, hooks, MCP configuration, runtime files, and Grok/Cursor plugins; Codex specifically receives AGENTS.md, hooks.json, and MCP server entries. Although it skips local workspace and CI installs and no exfiltration was confirmed, the automatic global-install mutation of broad foreign AI-agent control surfaces is concrete and unconsented.

Rationale

Source inspection confirms a postinstall-triggered, broad user-level AI-agent control-surface mutation. This meets the blocking policy regardless of the absence of confirmed network exfiltration.

Evidence

package.jsonscripts/postinstall.jsscripts/lib/npm-lifecycle-adapter.jsscripts/lib/global-host-target.jsscripts/lib/global-host-config.jsscripts/lib/global-host-config-transaction.js$HOME/.copilot

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

8L9: const fs = require('fs') L10: const os = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L8

scripts/lib/global-host-config.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L226: addInstructionRoot(operations, target.host, packageRoot, path.join(runtime, 'instructions.full.md'), fsImpl) L227: addSourceFile(operations, target.host, path.join(packageRoot, 'host-projections', 'AGENTS.md'), path.join(runtime, 'AGENTS.md'), fsImpl) L228: addSourceTree(operations, target.host, path.join(packageRoot, 'hooks', '_runtime'), path.join(runtime, 'hooks', '_runtime'), fsImpl) ... L332: * Map global host id → memory/profile agent identity (VALID_AGENTS). L333: * Claude host root is `.claude` but agent id is `claude-code`. L334: */ ... L342: L343: function buildMcpServers(runtimeRoot, options = {}) { L344: const agent = hostToRuntimeAgent(options.agent || options.host) ... L364: L365: function buildCop

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/lib/global-host-config.jsView on unpkg · L1

scripts/lib/host-adapter-scope.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. anned-install') : (after.repoid && sourcedigest === installeddigest ? 'verified' : 'mismatch') if (!dryrun && status !== 'verified') { const error = new error('grok_plugin_install_mismatch: installed plugin bytes differ from workspace owner') error.code = 'grok_plugin_install_mismatch' throw error } return { schemaversion: 'grokplugininstallationreceiptv1', status, pluginpath: portable(source), repoid: after.repoid, installedpath: installedpath ? portable(installedpath) : null, sourcedigest, installeddigest, grokversion: string(probe.stdout || probe.stderr || '').trim(), refreshmode, dryrun } } function timestampsu

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/lib/host-adapter-scope.jsView on unpkg

hooks/_runtime/stdio-bounds.cjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/_runtime/stdio-bounds.cjsView on unpkg

scripts/test-runtime-rolling-upgrade.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.6 matchedPath = scripts/test-runtime-rolling-upgrade.js matchedIdentity = npm:ZGV2Y29kZXg:1.16.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-runtime-rolling-upgrade.jsView on unpkg

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.6 matchedPath = grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.16.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView on unpkg

scripts/lib/node-runtime-readiness.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.6 matchedPath = scripts/lib/node-runtime-readiness.js matchedIdentity = npm:ZGV2Y29kZXg:1.16.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/node-runtime-readiness.jsView on unpkg

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.6 matchedPath = grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.16.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView on unpkg

mcp/memory-server.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.16.6 matchedPath = mcp/memory-server.js matchedIdentity = npm:ZGV2Y29kZXg:1.16.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/memory-server.jsView on unpkg