dexrelay@0.1.74
Mac-side CLI/bootstrap runtime for the DexRelay iPhone app.
AI Security Review
scanned 18d ago · by lpm-firewall-aiSource inspection establishes unauthenticated network command execution activated by automatic installation. This warrants a critical-vulnerability warning; the inspected behavior does not establish malware intent or a block-eligible malicious chain.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A global npm installation on macOS starts the bridge; a reachable client sends a local/exec WebSocket RPC.
Impact
A reachable attacker can execute commands with the installing user's privileges and inherited environment.
Mechanism
The bridge binds to all network interfaces and passes client-supplied commands to spawn without authentication or an execution allowlist.
AI rationale
Source inspection establishes unauthenticated network command execution activated by automatic installation. This warrants a critical-vulnerability warning; the inspected behavior does not establish malware intent or a block-eligible malicious chain.
Evidence
package.jsonpostinstall.jsinstall.shbridge.js
Network endpoints1
0.0.0.0
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- package.json defines a postinstall hook; postinstall.js enables automatic bootstrap for global macOS installs unless skipped.
- postinstall.js runs install.sh automatically, which starts the bridge as a background service.
- install.sh forces the bridge to listen on 0.0.0.0; the default bridge port is 4615.
- bridge.js routes incoming WebSocket messages directly to its local RPC handler without authenticating the connection.
- The transport trust check applies only to Claude login methods. The local/exec RPC reaches unrestricted process spawning with the user's environment.
Evidence against
- The behavior fits a remote development bridge; inspected source does not establish malicious intent.
- Automatic bootstrap skips non-global installs, non-macOS platforms, CI, and an explicit skip setting.
- The indicated CODEX_HOME location supplies paths rather than modifying broad agent configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgservicectl.pyView file
•path = servicectl.py
kind = build_helper
sizeBytes = 13291
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
servicectl.pyView on unpkgdexrelay
Findings
6 High5 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddexrelay
HighKnown Malware Source Similaritybridge.js
HighKnown Malware Source Similaritypostinstall.js
HighKnown Malware Source Similarityinstall.sh
HighPrevious Version Dangerous Deltabridge.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperservicectl.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dexrelay@0.1.74.
See all versions of dexrelay for other recorded verdicts.
- Review the evidence and your use of dexrelay@0.1.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.