registry / grepmax / 0.26.23

grepmax@0.26.23

Semantic code search for coding agents. Local embeddings, LLM summaries, call graph tracing.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

On npm install for macOS arm64, a pre-existing ~/.gmax vendor directory causes replacement of @lancedb/lancedb's JavaScript distribution and native binary. This is an automatic, unverified native-code overlay; no confirmed exfiltration or AI-agent mutation occurs at install time.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install on darwin-arm64 with ~/.gmax/vendor/lancedb-0.38.0-beta.10 present

Impact

A locally supplied native binary becomes the dependency implementation used by grepmax.

Mechanism

postinstall copies unverified vendored native dependency files

AI rationale

The automatic unverified native dependency overlay is a real install-hook risk that warrants a warning. The flagged Codex configuration behavior is explicit-command-only, and no concrete exfiltration or malicious control-surface mutation was found.

Evidence

package.jsonscripts/postinstall.jsdist/commands/codex.jsdist/commands/plugin.jsdist/lib/workers/download-worker.js~/.gmax/vendor/lancedb-0.38.0-beta.10/dist~/.gmax/vendor/lancedb-0.38.0-beta.10/lancedb.darwin-arm64.node@lancedb/lancedb/dist@lancedb/lancedb/.gmax-vendored

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Install hook replaces a dependency's dist directory and native binary from ~/.gmax/vendor without integrity verification.
The replacement runs automatically on darwin-arm64 when the vendor files exist.

Evidence against

Postinstall does not modify AI-agent configuration.
Codex MCP registration and AGENTS.md writes are reached only through explicit gmax plugin commands.
Observed network download is model-file retrieval from Hugging Face; local service calls target 127.0.0.1.
No credential harvesting or exfiltration found in inspected source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 176 file(s), 1.85 MB of source, external domains: 127.0.0.1, github.com, huggingface.co

Source & flagged code

7 flagged

package.jsonView file

Lines 1-41json

2 "name": "grepmax",

3 "version": "0.26.23",

4 "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",

5 "homepage": "https://github.com/reowens/grepmax",

6 "bugs": {

7 "url": "https://github.com/reowens/grepmax/issues"

8 },

9 "repository": {

10 "type": "git",

11 "url": "https://github.com/reowens/grepmax.git"

12 },

13 "main": "dist/index.js",

14 "bin": {

15 "gmax": "dist/index.js"

16 },

17 "engines": {

18 "node": ">=22.12.0"

19 },

20 "scripts": {

21 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prebuild": "rm -rf dist tsconfig.tsbuildinfo && mkdir -p dist",

23 "build": "tsc",

24 "postbuild": "chmod +x dist/index.js",

25 "dev": "npx tsc && node dist/index.js",

26 "test": "vitest run",

27 "test:watch": "vitest",

28 "bench:recall": "npx tsx src/eval.ts",

29 "bench:recall:json": "GMAX_EVAL_JSON=1 npx tsx src/eval.ts",

30 "bench:oss": "npx tsx src/eval-oss.ts all",

31 "bench:oss:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-oss.ts all",

32 "bench:tokens": "npx tsx src/eval-tokens.ts",

33 "bench:tokens:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-tokens.ts",

34 "bench:surprises": "npx tsx src/eval-surprising-connections.ts",

35 "bench:surprises:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-surprising-connections.ts",

36 "format": "biome format --write .",

37 "format:check": "biome check .",

38 "lint": "biome lint .",

39 "lint:fix": "biome check --write .",

40 "typecheck": "tsc --noEmit",

41 "test:typecheck": "tsc -p tsconfig.tests.json",

dist/eval-graph-sanity.jsView file

Lines 52-92javascript

52 return function (mod) {

53 if (mod && mod.__esModule) return mod;

54 var result = {};

55 if (mod !=

dist/lib/search/pagerank.jsView file

Lines 163-203javascript

163 if (!set) {

164 set = new Set();

165 edges.set(d, set);

166 }

167 for (const r

dist/commands/codex.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: strict"; var __awaiter = (this && this.__awaiter) || function (thisarg, _arguments, p, generator) { function adopt(value) { return value instanceof p ? value : new p(function (resolve) { resolve(value); }); } return new (p || (p = promise))(function (resolve, reject) { function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisarg, _arguments || [])).next()); }); }; var __importdefault

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/codex.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. "use strict"; var __awaiter = (this && this.__awaiter) || function (thisarg, _arguments, p, generator) { function adopt(value) { return value instanceof p ? value : new p(function (resolve) { resolve(value); }); } return new (p || (p = promise))(function (resolve, reject) { function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisarg, _arguments || [])).next());

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

mlx-embed-server/server.pyView file

•path = mlx-embed-server/server.py kind = build_helper sizeBytes = 8671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlx-embed-server/server.pyView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/eval-graph-sanity.jsView file

72(_a = (_c = process.env).GMAX_WORKER_COUNT) !== null && _a !== void 0 ? _a : (_c.GMAX_WORKER_COUNT = "1"); L73: const node_child_process_1 = require("node:child_process"); L74: const path = __importStar(require("node:path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/eval-graph-sanity.jsView on unpkg · L72

dist/lib/search/pagerank.jsView file

183var _a; L184: const env = Number.parseInt((_a = process.env.GMAX_PAGERANK_TTL_MS) !== null && _a !== void 0 ? _a : "", 10); L185: return Number.isFinite(env) && env > 0 ? env : DEFAULT_TTL_MS; ... L191: try { L192: const data = JSON.parse(fs.readFileSync(file, "utf8")); L193: const computedAt = Date.parse(data.computedAt);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/search/pagerank.jsView on unpkg · L183

dist/commands/codex.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/codex.jsView on unpkg

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/codex.jsView on unpkg

mlx-embed-server/server.pyView file

•path = mlx-embed-server/server.py kind = build_helper sizeBytes = 8671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlx-embed-server/server.pyView on unpkg

Findings

3 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationdist/commands/codex.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/codex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/eval-graph-sanity.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpermlx-embed-server/server.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowWeak Cryptodist/lib/search/pagerank.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to grepmax@0.26.23.

See version security history for other recorded verdicts.

Review the evidence and your use of grepmax@0.26.23 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 03:40:24.986Z (UTC).

87%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeInstall Hook Abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorRobert Owens

Maintainersreoiv

Version0.26.23

Latest on npm0.26.69

PublishedAug 26, 2026

LicenseApache-2.0

Dependencies21

Integrityverified

Package size532 KB

Files193

Keywordsgrepmaxgrepsearchsemantic-searchcode-searchcode-intelligenceembeddingsvector-search

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jsbin → gmax

Runtimenode >=22.12.0

Artifact2.25 MB · 193 files1 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean