Loading npm security reports…

grepmax@0.26.26: Malicious npm security report (Block) | LPM Firewall

registry / grepmax / 0.26.26

grepmax@0.26.26

Semantic code search for coding agents. Local embeddings, LLM summaries, call graph tracing.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Installing the package automatically replaces a dependency's JavaScript distribution and native module when a matching home-directory payload is present. The replacement has no checksum, signature, or package-bound source validation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation on Darwin arm64 when ~/.gmax/vendor/lancedb-0.38.0-beta.10 contains dist and lancedb.darwin-arm64.node.

Impact

A staged native binary can execute with the privileges of any program that loads @lancedb/lancedb from the installed project.

Mechanism

Postinstall replacement of an installed dependency with an externally staged native payload.

Attack narrative

During installation, the postinstall script checks for a payload outside the package in ~/.gmax/vendor. If present on Darwin arm64, it removes the installed @lancedb/lancedb dist directory, copies the external replacement, and installs its native module. The package does not verify the external contents before placing them into a consumer dependency that will load the native binary later.

AI rationale

This is an automatic install-hook supply-chain mutation that imports an unverified external native payload into a consumer dependency. The explicit plugin commands do not mitigate the separate postinstall behavior.

Evidence

package.jsonscripts/postinstall.js~/.gmax/vendor/lancedb-0.38.0-beta.10/dist~/.gmax/vendor/lancedb-0.38.0-beta.10/lancedb.darwin-arm64.nodenode_modules/@lancedb/lancedb/distnode_modules/@lancedb/lancedb/.gmax-vendored

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/eval-graph-sanity.jsView file

72(_a = (_c = process.env).GMAX_WORKER_COUNT) !== null && _a !== void 0 ? _a : (_c.GMAX_WORKER_COUNT = "1"); L73: const node_child_process_1 = require("node:child_process"); L74: const path = __importStar(require("node:path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/eval-graph-sanity.jsView on unpkg · L72

dist/lib/search/pagerank.jsView file

183var _a; L184: const env = Number.parseInt((_a = process.env.GMAX_PAGERANK_TTL_MS) !== null && _a !== void 0 ? _a : "", 10); L185: return Number.isFinite(env) && env > 0 ? env : DEFAULT_TTL_MS; ... L191: try { L192: const data = JSON.parse(fs.readFileSync(file, "utf8")); L193: const computedAt = Date.parse(data.computedAt);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/search/pagerank.jsView on unpkg · L183

dist/commands/codex.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: strict"; var __awaiter = (this && this.__awaiter) || function (thisarg, _arguments, p, generator) { function adopt(value) { return value instanceof p ? value : new p(function (resolve) { resolve(value); }); } return new (p || (p = promise))(function (resolve, reject) { function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisarg, _arguments || [])).next()); }); }; var __importdefault

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/codex.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. "use strict"; var __awaiter = (this && this.__awaiter) || function (thisarg, _arguments, p, generator) { function adopt(value) { return value instanceof p ? value : new p(function (resolve) { resolve(value); }); } return new (p || (p = promise))(function (resolve, reject) { function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisarg, _arguments || [])).next());

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

mlx-embed-server/server.pyView file

•path = mlx-embed-server/server.py kind = build_helper sizeBytes = 8671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlx-embed-server/server.pyView on unpkg

dist/commands/add.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/add.js#virtual:normalized:round1View on unpkg

dist/commands/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = grepmax@0.26.28 matchedIdentity = npm:Z3JlcG1heA:0.26.28 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "grepmax",

3 "version": "0.26.26",

4 "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",

5 "homepage": "https://github.com/reowens/grepmax",

6 "bugs": {

7 "url": "https://github.com/reowens/grepmax/issues"

8 },

9 "repository": {

10 "type": "git",

11 "url": "https://github.com/reowens/grepmax.git"

12 },

13 "main": "dist/index.js",

14 "bin": {

15 "gmax": "dist/index.js"

16 },

17 "engines": {

18 "node": ">=22.12.0"

19 },

20 "scripts": {

21 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prebuild": "rm -rf dist tsconfig.tsbuildinfo && mkdir -p dist",

23 "build": "tsc",

24 "postbuild": "chmod +x dist/index.js",

25 "dev": "npx tsc && node dist/index.js",

26 "test": "vitest run",

27 "test:watch": "vitest",

28 "bench:recall": "npx tsx src/eval.ts",

29 "bench:recall:json": "GMAX_EVAL_JSON=1 npx tsx src/eval.ts",

30 "bench:oss": "npx tsx src/eval-oss.ts all",

31 "bench:oss:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-oss.ts all",

32 "bench:tokens": "npx tsx src/eval-tokens.ts",

33 "bench:tokens:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-tokens.ts",

34 "bench:surprises": "npx tsx src/eval-surprising-connections.ts",

35 "bench:surprises:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-surprising-connections.ts",

36 "format": "biome format --write .",

37 "format:check": "biome check .",

38 "lint": "biome lint .",

39 "lint:fix": "biome check --write .",

40 "typecheck": "tsc --noEmit",

41 "test:typecheck": "tsc -p tsconfig.tests.json",

dist/eval-graph-sanity.jsView file

Lines 52-92javascript

52 return function (mod) {

53 if (mod && mod.__esModule) return mod;

54 var result = {};

55 if (mod !=

dist/lib/search/pagerank.jsView file

Lines 163-203javascript

163 if (!set) {

164 set = new Set();

165 edges.set(d, set);

166 }

167 for (const r

dist/commands/codex.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: strict"; var __awaiter = (this && this.__awaiter) || function (thisarg, _arguments, p, generator) { function adopt(value) { return value instanceof p ? value : new p(function (resolve) { resolve(value); }); } return new (p || (p = promise))(function (resolve, reject) { function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisarg, _arguments || [])).next()); }); }; var __importdefault

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/codex.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. "use strict"; var __awaiter = (this && this.__awaiter) || function (thisarg, _arguments, p, generator) { function adopt(value) { return value instanceof p ? value : new p(function (resolve) { resolve(value); }); } return new (p || (p = promise))(function (resolve, reject) { function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisarg, _arguments || [])).next());

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

mlx-embed-server/server.pyView file

•path = mlx-embed-server/server.py kind = build_helper sizeBytes = 8671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlx-embed-server/server.pyView on unpkg

dist/commands/add.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/add.js#virtual:normalized:round1View on unpkg

dist/commands/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = grepmax@0.26.28 matchedIdentity = npm:Z3JlcG1heA:0.26.28 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg