docdex@0.2.93: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

docdex@0.2.93: AI-agent control-surface risk | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./lib/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/docdex-mcp-stdio.jsView file

3L4: const { runBridge } = require("../lib/mcp_stdio_bridge"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docdex-mcp-stdio.jsView on unpkg · L3

lib/postinstall_setup.jsView file

4const fs = require("node:fs"); L5: const net = require("node:net"); L6: const http = require("node:http"); ... L10: const tty = require("node:tty"); L11: const { spawn, spawnSync } = require("node:child_process"); L12: ... L51: function defaultConfigPath() { L52: return path.join(os.homedir(), ".docdex", "config.toml"); L53: } ... L69: const paths = []; L70: if (process.env.DOCDEX_DAEMON_LOCK_PATH) { L71: paths.push(process.env.DOCDEX_DAEMON_LOCK_PATH);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/postinstall_setup.jsView on unpkg · L4

4Trigger-reachable persistence chain: scripts.postinstall -> lib/install.js -> lib/postinstall_setup.js L4: const fs = require("node:fs"); L5: const net = require("node:net"); L6: const http = require("node:http"); ... L10: const tty = require("node:tty"); L11: const { spawn, spawnSync } = require("node:child_process"); L12: ... L51: function defaultConfigPath() { L52: return path.join(os.homedir(), ".docdex", "config.toml"); L53: } ... L69: const paths = []; L70: if (process.env.DOCDEX_DAEMON_LOCK_PATH) { L71: paths.push(process.env.DOCDEX_DAEMON_LOCK_PATH);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/postinstall_setup.jsView on unpkg · L4

4const fs = require("node:fs"); L5: const net = require("node:net"); L6: const http = require("node:http"); ... L10: const tty = require("node:tty"); L11: const { spawn, spawnSync } = require("node:child_process"); L12: ... L51: function defaultConfigPath() { L52: return path.join(os.homedir(), ".docdex", "config.toml"); L53: } ... L69: const paths = []; L70: if (process.env.DOCDEX_DAEMON_LOCK_PATH) { L71: paths.push(process.env.DOCDEX_DAEMON_LOCK_PATH);

Medium

lib/install.jsView file

1Install-time AI-agent control hijack evidence: L43: const LOCAL_BINARY_ENV = "DOCDEX_LOCAL_BINARY"; L44: const AGENTS_DOC_FILENAME = "agents.md"; L45: const CLI_WRAPPER_SCRIPT = [ ... L254: try { L255: fs.mkdirSync(path.dirname(targetPath), { recursive: true, mode: 0o700 }); L256: const existing = fs.existsSync(targetPath) ? fs.readFileSync(targetPath, "utf8") : null; L257: if (existing === contents) return false; L258: fs.writeFileSync(targetPath, contents); L259: return true; ... L285: try { L286: fsModule.mkdirSync(binDir, { recursive: true }); L287: } catch (err) { Payload evidence from assets/agents.md: L1: ---- START OF DOCDEX INFO V0.2.93 ---- L2: Docdex URL: http://127.0.0.1:28491 L3: Use this base URL for Docdex HTTP endpoints.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.jsView on unpkg · L1

Source & flagged code

7 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "docdex",

3 "version": "0.2.93",

4 "mcpName": "io.github.bekirdag/docdex",

5 "description": "Local-first documentation and code indexer with HTTP/MCP search, AST, and agent memory.",

6 "bin": {

7 "docdex": "lib/cli_entry.js",

8 "docdexd": "lib/cli_entry.js",

9 "docdex-mcp-stdio": "lib/mcp_stdio_cli.js"

10 },

11 "files": [

12 "bin",

13 "lib",

14 "assets",

15 "README.md",

16 "CHANGELOG.md",

17 "LICENSE"

18 ],

19 "scripts": {

20 "postinstall": "node ./lib/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "preuninstall": "node ./lib/uninstall.js",

22 "postuninstall": "node ./lib/uninstall.js",

23 "test": "node --test",

24 "pack:verify": "node --test test/packaging_guardrails.test.js"

25 },

26 "engines": {

27 "node": ">=18"

28 },

29 "os": [

30 "darwin",

31 "linux",

32 "win32"

33 ],

34 "cpu": [

35 "arm64",

36 "x64"

37 ],

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/bekirdag/docdex.git"

bin/docdex-mcp-stdio.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2"use strict";

3

4const { runBridge } = require("../lib/mcp_stdio_bridge");

5

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docdex-mcp-stdio.jsView on unpkg · L3

6async function

lib/postinstall_setup.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3

4const fs = require("node:fs");

5const net = require("node:net");

lib/install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

3

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.jsView on unpkg · L1

4const fs = require("node:fs");

5const http