Loading npm security reports…
DevCodex — cross-host AI coding engineering harness for Codex, Claude Code, GitHub Copilot, Gemini CLI, Grok, and Cursor
Static analysis flagged 20 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references weak cryptographic algorithms.
scripts/test-task-admission-authority.jsView on unpkg · L45Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/lib/devcodex-readiness.jsView on unpkg · L1Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
scripts/lib/host-adapter-scope.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
hooks/_runtime/stdio-bounds.cjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/lib/global-host-runtime-verifier.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/test-runtime-rolling-upgrade.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/lib/node-runtime-readiness.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/test-derived-state-lock-concurrency.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView on unpkgThis report applies to devcodex@1.19.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L10Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/lib/devcodex-readiness.jsView on unpkg · L1Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
scripts/lib/host-adapter-scope.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
hooks/_runtime/stdio-bounds.cjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/lib/global-host-runtime-verifier.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/test-runtime-rolling-upgrade.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/lib/node-runtime-readiness.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/test-derived-state-lock-concurrency.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView on unpkgPackage source references weak cryptographic algorithms.
scripts/test-task-admission-authority.jsView on unpkg · L45