Loading npm security reports…

devcodex@1.19.5: AI-agent control-surface risk | LPM Firewall

registry / devcodex / 1.19.5

devcodex@1.19.5

DevCodex — cross-host AI coding engineering harness for Codex, Claude Code, GitHub Copilot, Gemini CLI, Grok, and Cursor

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically changes user-wide configuration for six AI coding products. It registers instructions, hooks, MCP servers, plugins, and package runtime code that run during later agent events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing or updating the package globally through npm.

Impact

The package gains persistent execution and control over AI-agent sessions across the user's installed hosts.

Mechanism

Postinstall applies multi-host user-level agent configuration and command hooks.

Policy narrative

The package uses npm postinstall as an automatic installer for a broad user-level AI-agent control surface. A global installation applies configuration for Copilot, Claude, Codex, Gemini, Grok, and Cursor, including hooks that later spawn package adapters with the active environment. This is not limited to package-owned state or an explicit follow-up command, so installing the package changes unrelated host configurations and creates persistent agent-session execution.

Rationale

The source confirms unconsented postinstall mutation of broad, foreign AI-agent configuration and hooks on global install. This meets the install-control-surface block policy despite no observed exfiltration or network payload.

Evidence

package.jsonscripts/postinstall.jsscripts/lib/npm-lifecycle-adapter.jsscripts/lib/global-host-config.jsscripts/lib/global-host-target.jshooks/_runtime/host-hook-launcher.cjs

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

8L9: const fs = require('fs') L10: const os = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L8

scripts/test-task-admission-authority.jsView file

51} L52: const KEEP_TEST_ARTIFACTS = process.env.DEVCODEX_KEEP_TEST_ARTIFACTS === '1' L53: const TEST_RUNTIME = { ... L65: fs.mkdirSync(path.join(activeRoot, 'profile'), { recursive: true }) L66: fs.writeFileSync(path.join(physicalRoot, 'package.json'), '{}\n') L67: return { physicalRoot, activeRoot, project: name } ... L443: const identityPath = path.join(baseTaskRoot, '.memory', 'task.json') L444: const identity = JSON.parse(fs.readFileSync(identityPath, 'utf8')) L445: assert.strictEqual(identity.schemaVersion, 'TaskIdentityV2') ... L1561: fs.mkdirSync(path.join(reparseRoot.activeRoot, 'bugs'), { recursive: true }) L1562: fs.symlinkSync(outside, path.join(reparseRoot.activeRoot, 'bugs', '任务-reparse'), process.platform === 'win32' ? 'junction' : 'dir') L1563: const reparseInput = admis

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/test-task-admission-authority.jsView on unpkg · L51

scripts/lib/devcodex-readiness.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L62: const env = options.env || process.env L63: const sessionId = String(env.CODEX_THREAD_ID || '').trim() L64: if (!sessionId) return null ... L179: } L180: fsImpl.mkdirSync(directory, { recursive: true }) L181: const unsafeAfter = unsafePathComponent(sharedRoot, file, fsImpl) ... L198: } L199: fsImpl.writeFileSync(temporary, `${JSON.stringify(payload, null, 2)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 }) L200: fsImpl.renameSync(temporary, file) ... L334: facts.globalLifecycleFilesPresent.status === 'BLOCK' || L335: facts.codexAdapterContractReady.status === 'BLOCK' || L336: facts.managedConfigDrift.status === 'BLOCK') { Write operation from scripts/lib/devcodex-readiness.js: L62: const env = options.env || pro

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/lib/devcodex-readiness.jsView on unpkg · L1

scripts/lib/host-adapter-scope.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. anned-install') : (after.repoid && sourcedigest === installeddigest ? 'verified' : 'mismatch') if (!dryrun && status !== 'verified') { const error = new error('grok_plugin_install_mismatch: installed plugin bytes differ from workspace owner') error.code = 'grok_plugin_install_mismatch' throw error } return { schemaversion: 'grokplugininstallationreceiptv1', status, pluginpath: portable(source), repoid: after.repoid, installedpath: installedpath ? portable(installedpath) : null, sourcedigest, installeddigest, grokversion: string(probe.stdout || probe.stderr || '').trim(), refreshmode, dryrun } } function timestampsu

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/lib/host-adapter-scope.jsView on unpkg

hooks/_runtime/stdio-bounds.cjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/_runtime/stdio-bounds.cjsView on unpkg

scripts/lib/global-host-runtime-verifier.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/lib/global-host-runtime-verifier.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/global-host-runtime-verifier.jsView on unpkg

scripts/probe-skill-route-s15-host.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/probe-sk[redacted] matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/probe-skill-route-s15-host.jsView on unpkg

scripts/test-host-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/test-host-adapters.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-host-adapters.jsView on unpkg

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjsView on unpkg

mcp/profile-server.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = mcp/profile-server.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/profile-server.jsView on unpkg

scripts/lib/node-runtime-readiness.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/lib/node-runtime-readiness.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/node-runtime-readiness.jsView on unpkg

scripts/test-derived-state-lock-concurrency.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/test-derived-state-lock-concurrency.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-derived-state-lock-concurrency.jsView on unpkg

scripts/test-security-audit.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/test-security-audit.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-security-audit.jsView on unpkg

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjs matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

grok/plugins/devcodex-workspace/mcp/workspace-bridge.cjsView on unpkg

scripts/instruction-fallback-check.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/instruction-fallback-check.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/instruction-fallback-check.jsView on unpkg

scripts/test-artifact-mutation-authority.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/test-artifact-mutation-authority.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-artifact-mutation-authority.jsView on unpkg

scripts/test-host-capability-routing.jsView file

•matchType = normalized_sha256 matchedPackage = devcodex@1.19.4 matchedPath = scripts/test-host-capability-routing.js matchedIdentity = npm:ZGV2Y29kZXg:1.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/test-host-capability-routing.jsView on unpkg