registry / AI-agent control-surface risk / duya-workspace

duya-workspace

Connect a local coding agent to a Duya Workspace and expose its shared memory, tasks, and activity through MCP.

This report shows the evidence for duya-workspace@0.1.0, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms unconsented install-time mutation of global Codex configuration, instructions, and skills. This meets the blocking boundary even though no separate credential theft or install-time network activity was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Automatic npm `install` lifecycle execution.

Impact

Future Codex sessions can start the package-controlled MCP server and receive package-provided agent guidance.

Mechanism

Global Codex MCP and AGENTS/skill configuration mutation.

Policy narrative

Installing the package automatically invokes `node dist/cli.js install`. That command writes a global Codex MCP configuration pointing to the installed package executable, adds managed instructions to global `AGENTS.md`, and copies a skill into the global Codex skills directory. These changes occur without an explicit setup command or user approval, creating persistence in a foreign, broad AI-agent control surface.

AI rationale

Evidence

package.jsondist/cli.jsskills/duya-workspace/SKILL.mdREADME.md~/.codex/config.toml~/.codex/AGENTS.md~/.codex/skills/duya-workspace/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json defines npm `install` lifecycle hook.
`dist/cli.js` install command runs automatically during npm install.
Installer writes a managed MCP server entry to `~/.codex/config.toml`.
Installer modifies `~/.codex/AGENTS.md` and copies a skill into `~/.codex/skills/duya-workspace/SKILL.md`.
The registered MCP entry executes this package's `dist/cli.js mcp` in future Codex sessions.

Evidence against

Install path does not initiate network requests or browser launch.
No arbitrary shell command execution beyond browser opening in explicit connect.
Network API URL and token are user-supplied or obtained after explicit device approval.
No credential harvesting, destructive deletion beyond its managed uninstall files, or remote payload loading found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

Manifest

Source & flagged code

4 flagged

package.jsonView file

•scripts.install = npm run build && node dist/cli.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = npm run build && node dist/cli.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

3// src/connect.ts L4: import { spawn } from "child_process"; L5:

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L3

32async function postJson(url, body) { L33: const response = await fetch(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }); L34: return { status: response.status, data: await response.json() }; ... L38: const args2 = process.platform === "win32" ? ["/c", "start", "", url] : [url]; L39: const child = spawn(command2, args2, { detached: true, stdio: "ignore", windowsHide: true }); L40: child.unref(); ... L45: if (status !== 201) throw new Error(data.error ?? `Connection start failed (${status})`); L46: process.stderr.write(` L47: Duya Workspace connection code: ${data.user_code}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L32

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.install = npm run build && node dist/cli.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = npm run build && node dist/cli.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

3// src/connect.ts L4: import { spawn } from "child_process"; L5:

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L3

Findings

4 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowNo License

Affected versions and remediation

This report applies to duya-workspace@0.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing duya-workspace@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-12 12:07:06.806Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.1.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 12, 2026, 12:03 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code