Loading npm security reports…

greprag@5.60.4: AI-agent control-surface risk | LPM Firewall

registry / greprag / 5.60.4

greprag@5.60.4

GrepRAG — agent memory for Claude Code, Codex, and OpenCode.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates detected third-party AI-agent control surfaces. It installs package-authored instructions into Codex and Claude Code skill directories without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation when ~/.codex or ~/.claude exists

Impact

Package-authored instructions become available to installed AI agents and existing auxiliary skills are overwritten on refresh.

Mechanism

automatic AI-agent skill deployment

Policy narrative

On npm postinstall, the package detects existing Codex or Claude Code homes and copies its bundled skill instructions into their global skill registries. This happens without an explicit greprag setup command; it also refreshes any pre-existing bundled auxiliary skills. The injected GrepRAG skill directs agent configuration and operational commands, creating an unconsented AI-agent control-surface mutation.

Rationale

The install hook concretely writes package-controlled AI-agent instructions into foreign global agent directories. This meets the blocking policy for unconsented postinstall mutation of a broad AI-agent control surface.

Evidence

package.jsonscripts/postinstall.jsskill/greprag/SKILL.mdskill/greprag/**~/.codex/skills/greprag/**~/.claude/skills/greprag/**~/.codex/skills/<existing-skill>/**~/.claude/skills/<existing-skill>/**

Decision evidence

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/project-anchor.jsView file

54exports.setProjectRole = setProjectRole; L55: const path = __importStar(require("path")); L56: const fs = __importStar(require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/project-anchor.jsView on unpkg · L54

dist/commands/codex-startup.jsView file

45function home() { L46: return process.env.HOME || process.env.USERPROFILE || os.homedir(); L47: } ... L53: } L54: function powershellQuote(s) { L55: return `'${s.replace(/'/g, "''")}'`; ... L68: cli: stableExecutable(path.join(__dirname, '..', 'index.js')), L69: args: process.platform === 'win32' L70: ? ['codex', 'watch', '--all', '--delivery', 'native'] ... L87: const file = path.join(home(), 'Library', 'LaunchAgents', 'com.greprag.codex-watch.plist'); L88: return { kind: 'macOS LaunchAgent', path: file, installed: fs.existsSync(file), hint: 'Load with launchctl or log out/in.' }; L89: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/codex-startup.jsView on unpkg · L45

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L24: name: 'Claude Code', L25: agentDir: path.join(home, '.claude'), L26: skillsTarget: path.join(home, '.claude', 'skills'), L27: docsTarget: path.join(home, '.claude', 'docs'), L28: refreshClaudeDocs: true, ... L31: name: 'Codex', L32: agentDir: path.join(home, '.codex'), L33: skillsTarget: path.join(home, '.codex', 'skills'), L34: docsTarget: path.join(home, '.codex', 'docs'), L35: refreshClaudeDocs: false, ... L39: function copyDir(src, dest) { L40: fs.mkdirSync(dest, { recursive: true }); Payload evidence from skill/content-advisor/SKILL.md: L1: --- L2: name: content-advisor

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L1

Source & flagged code

5 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "greprag",

3 "version": "5.60.4",

4 "description": "GrepRAG — agent memory for Claude Code, Codex, and OpenCode.",

5 "main": "dist/index.js",

6 "bin": {

7 "greprag": "dist/index.js",

8 "greprag-hook": "dist/hook.js"

9 },

10 "scripts": {

11 "build": "tsc && node scripts/bundle-opencode-plugin.mjs",

12 "clean": "rimraf dist",

13 "release:prepare": "npm run clean && npm run build && node scripts/verify-publish.cjs",

14 "prepublishOnly": "npm run release:prepare",

15 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "files": [

18 "dist",

19 "skill",

20 "scripts"

21 ],

22 "devDependencies": {

23 "@types/node": "^20.0.0",

24 "@types/sql.js": "^1.4.11",

25 "esbuild": "^0.17.19",

26 "rimraf": "^5.0.0",

27 "typescript": "^5.5.0"

28 },

29 "engines": {

30 "node": ">=18.0.0"

31 },

32 "keywords": [

33 "greprag",

34 "claude",

35 "codex",

dist/project-anchor.jsView file

Lines 34-74javascript

34 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

35 return ar;

36 };

37

dist/commands/codex-startup.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// Runs automatically after `npm install -g greprag`.

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L1

3//

4// Public UX contract:

5// * `greprag/` — the package's front-door skill. Always installed/refreshed

6// for detected Claude Code and Codex homes so users can type `/greprag`

7// immediately after installing the npm package.

8// * Other bundled skills — refresh-only. If the operator opted in earlier,