Loading npm security reports…

docdex@0.2.96: AI-agent control-surface risk | LPM Firewall

registry / docdex / 0.2.96

docdex@0.2.96

Local-first documentation and code indexer with HTTP/MCP search, AST, and agent memory.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall downloads and starts a daemon, persists it as a user service, and mutates broad third-party AI-client MCP and instruction surfaces without user action. The injected instructions direct agents to prioritize Docdex tools and web research.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of docdex

Impact

Future AI-agent sessions can be redirected to the package's local MCP service and attacker-authored instructions.

Mechanism

postinstall AI-agent configuration hijack with daemon persistence

Policy narrative

Installing the package automatically downloads a native daemon, registers persistence, adds an MCP endpoint to numerous unrelated AI clients, and writes package-authored mandatory instructions into agent control files. This is unconsented postinstall mutation of a broad foreign AI-agent control surface.

Rationale

The lifecycle chain is source-confirmed and unguarded for npm installs; its setup does not limit configuration writes to a package-owned surface. This meets the blocking policy independent of scanner similarity signals.

Evidence

package.jsonlib/install.jslib/postinstall_setup.jslib/uninstall.jsassets/agents.md~/.codex/config.toml~/.codex/AGENTS.md~/.claude.json~/.cursor/mcp.json~/Library/Application Support/Code/User/mcp.json

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./lib/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/docdex-mcp-stdio.jsView file

3L4: const { runBridge } = require("../lib/mcp_stdio_bridge"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docdex-mcp-stdio.jsView on unpkg · L3

lib/postinstall_setup.jsView file

4const fs = require("node:fs"); L5: const net = require("node:net"); L6: const http = require("node:http"); ... L10: const tty = require("node:tty"); L11: const { spawn, spawnSync } = require("node:child_process"); L12: ... L51: function defaultConfigPath() { L52: return path.join(os.homedir(), ".docdex", "config.toml"); L53: } ... L69: const paths = []; L70: if (process.env.DOCDEX_DAEMON_LOCK_PATH) { L71: paths.push(process.env.DOCDEX_DAEMON_LOCK_PATH);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/postinstall_setup.jsView on unpkg · L4

4Trigger-reachable persistence chain: scripts.postinstall -> lib/install.js -> lib/postinstall_setup.js L4: const fs = require("node:fs"); L5: const net = require("node:net"); L6: const http = require("node:http"); ... L10: const tty = require("node:tty"); L11: const { spawn, spawnSync } = require("node:child_process"); L12: ... L51: function defaultConfigPath() { L52: return path.join(os.homedir(), ".docdex", "config.toml"); L53: } ... L69: const paths = []; L70: if (process.env.DOCDEX_DAEMON_LOCK_PATH) { L71: paths.push(process.env.DOCDEX_DAEMON_LOCK_PATH);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/postinstall_setup.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = lib/postinstall_setup.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall_setup.js

lib/install.jsView file

43const LOCAL_BINARY_ENV = "DOCDEX_LOCAL_BINARY"; L44: const AGENTS_DOC_FILENAME = "agents.md"; L45: const CLI_WRAPPER_SCRIPT = [ ... L254: try { L255: fs.mkdirSync(path.dirname(targetPath), { recursive: true, mode: 0o700 }); L256: const existing = fs.existsSync(targetPath) ? fs.readFileSync(targetPath, "utf8") : null; L257: if (existing === contents) return false; L258: fs.writeFileSync(targetPath, contents); L259: return true; ... L285: try { L286: fsModule.mkdirSync(binDir, { recursive: true }); L287: } catch (err) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.jsView on unpkg · L43

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = lib/install.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 237ea95a332bde2b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = docdex@0.2.95 matchedPath = lib/install.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/docdex.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/docdex.jsView on unpkg

lib/cli_entry.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli_entry.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "docdex",

3 "version": "0.2.96",

4 "mcpName": "io.github.bekirdag/docdex",

5 "description": "Local-first documentation and code indexer with HTTP/MCP search, AST, and agent memory.",

6 "bin": {

7 "docdex": "lib/cli_entry.js",

8 "docdexd": "lib/cli_entry.js",

9 "docdex-mcp-stdio": "lib/mcp_stdio_cli.js"

10 },

11 "files": [

12 "bin",

13 "lib",

14 "assets",

15 "README.md",

16 "CHANGELOG.md",

17 "LICENSE"

18 ],

19 "scripts": {

20 "postinstall": "node ./lib/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "preuninstall": "node ./lib/uninstall.js",

22 "postuninstall": "node ./lib/uninstall.js",

23 "test": "node --test",

24 "pack:verify": "node --test test/packaging_guardrails.test.js"

25 },

26 "engines": {

27 "node": ">=18"

28 },

29 "os": [

30 "darwin",

31 "linux",

32 "win32"

33 ],

34 "cpu": [

35 "arm64",

36 "x64"

37 ],

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/bekirdag/docdex.git"

bin/docdex-mcp-stdio.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2"use strict";

3

4const { runBridge } = require("../lib/mcp_stdio_bridge");

5

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docdex-mcp-stdio.jsView on unpkg · L3

6async function

lib/postinstall_setup.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3

4const fs = require("node:fs");

5const net = require("node:net");

lib/install.jsView file

Lines 23-63javascript

23const { runPostInstallSetup } = require("./postinstall_setup");

24const { resolveDistBaseDir, resolveDistBaseCandidates } = require("./paths");

25

26const MAX_REDIRECTS

bin/docdex.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/docdex.jsView on unpkg

lib/cli_entry.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli_entry.jsView on unpkg