Loading npm security reports…

docdex@0.2.97: AI-agent control-surface risk | LPM Firewall

registry / docdex / 0.2.97

docdex@0.2.97

Local-first documentation and code indexer with HTTP/MCP search, AST, and agent memory.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates numerous third-party AI-agent configuration and instruction surfaces without user consent, registering Docdex as an MCP endpoint and injecting mandatory agent behavior. It also installs a user-level persistent daemon.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Future AI-agent sessions can be redirected to the local Docdex service and follow package-supplied mandatory directives.

Mechanism

broad AI-agent config/instruction injection plus daemon persistence

Policy narrative

Installing the package executes its postinstall hook. The hook downloads/runs a daemon, creates persistence, inserts Docdex MCP endpoints across unrelated AI clients, and writes mandatory instructions into their agent-control files. Those instructions compel use of the local service and web research, affecting later sessions without an explicit setup command.

Rationale

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, accompanied by persistence. Localhost binding does not remove the control-hijack risk because the injected MCP and instruction entries affect future client behavior.

Evidence

package.jsonlib/install.jslib/postinstall_setup.jsassets/agents.md~/.docdex/config.toml~/.codex/config.toml~/.claude.json~/.cursor/mcp.json~/Library/LaunchAgents/com.docdex.daemon.plist

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./lib/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/docdex-mcp-stdio.jsView file

3L4: const { runBridge } = require("../lib/mcp_stdio_bridge"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docdex-mcp-stdio.jsView on unpkg · L3

lib/postinstall_setup.jsView file

4const fs = require("node:fs"); L5: const net = require("node:net"); L6: const http = require("node:http"); ... L10: const tty = require("node:tty"); L11: const { spawn, spawnSync } = require("node:child_process"); L12: ... L51: function defaultConfigPath() { L52: return path.join(os.homedir(), ".docdex", "config.toml"); L53: } ... L69: const paths = []; L70: if (process.env.DOCDEX_DAEMON_LOCK_PATH) { L71: paths.push(process.env.DOCDEX_DAEMON_LOCK_PATH);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/postinstall_setup.jsView on unpkg · L4

4Trigger-reachable persistence chain: scripts.postinstall -> lib/install.js -> lib/postinstall_setup.js L4: const fs = require("node:fs"); L5: const net = require("node:net"); L6: const http = require("node:http"); ... L10: const tty = require("node:tty"); L11: const { spawn, spawnSync } = require("node:child_process"); L12: ... L51: function defaultConfigPath() { L52: return path.join(os.homedir(), ".docdex", "config.toml"); L53: } ... L69: const paths = []; L70: if (process.env.DOCDEX_DAEMON_LOCK_PATH) { L71: paths.push(process.env.DOCDEX_DAEMON_LOCK_PATH);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/postinstall_setup.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = lib/postinstall_setup.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall_setup.js

lib/install.jsView file

43const LOCAL_BINARY_ENV = "DOCDEX_LOCAL_BINARY"; L44: const AGENTS_DOC_FILENAME = "agents.md"; L45: const CLI_WRAPPER_SCRIPT = [ ... L254: try { L255: fs.mkdirSync(path.dirname(targetPath), { recursive: true, mode: 0o700 }); L256: const existing = fs.existsSync(targetPath) ? fs.readFileSync(targetPath, "utf8") : null; L257: if (existing === contents) return false; L258: fs.writeFileSync(targetPath, contents); L259: return true; ... L285: try { L286: fsModule.mkdirSync(binDir, { recursive: true }); L287: } catch (err) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.jsView on unpkg · L43

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = lib/install.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 237ea95a332bde2b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = docdex@0.2.95 matchedPath = lib/install.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/docdex.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/docdex.jsView on unpkg

lib/cli_entry.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli_entry.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "docdex",

3 "version": "0.2.97",

4 "mcpName": "io.github.bekirdag/docdex",

5 "description": "Local-first documentation and code indexer with HTTP/MCP search, AST, and agent memory.",

6 "bin": {

7 "docdex": "lib/cli_entry.js",

8 "docdexd": "lib/cli_entry.js",

9 "docdex-mcp-stdio": "lib/mcp_stdio_cli.js"

10 },

11 "files": [

12 "bin",

13 "lib",

14 "assets",

15 "README.md",

16 "CHANGELOG.md",

17 "LICENSE"

18 ],

19 "scripts": {

20 "postinstall": "node ./lib/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "preuninstall": "node ./lib/uninstall.js",

22 "postuninstall": "node ./lib/uninstall.js",

23 "test": "node --test",

24 "pack:verify": "node --test test/packaging_guardrails.test.js"

25 },

26 "engines": {

27 "node": ">=18"

28 },

29 "os": [

30 "darwin",

31 "linux",

32 "win32"

33 ],

34 "cpu": [

35 "arm64",

36 "x64"

37 ],

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/bekirdag/docdex.git"

bin/docdex-mcp-stdio.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2"use strict";

3

4const { runBridge } = require("../lib/mcp_stdio_bridge");

5

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docdex-mcp-stdio.jsView on unpkg · L3

6async function

lib/postinstall_setup.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3

4const fs = require("node:fs");

5const net = require("node:net");

lib/install.jsView file

Lines 23-63javascript

23const { runPostInstallSetup } = require("./postinstall_setup");

24const { resolveDistBaseDir, resolveDistBaseCandidates } = require("./paths");

25

26const MAX_REDIRECTS

bin/docdex.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/docdex.jsView on unpkg

lib/cli_entry.jsView file

•matchType = normalized_sha256 matchedPackage = docdex@0.2.95 matchedPath = bin/docdex.js matchedIdentity = npm:ZG9jZGV4:0.2.95 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli_entry.jsView on unpkg