greprag@5.65.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

greprag@5.65.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/codex-startup.jsView file

45function home() { L46: return process.env.HOME || process.env.USERPROFILE || os.homedir(); L47: } ... L53: } L54: function powershellQuote(s) { L55: return `'${s.replace(/'/g, "''")}'`; ... L68: cli: stableExecutable(path.join(__dirname, '..', 'index.js')), L69: args: process.platform === 'win32' L70: ? ['codex', 'watch', '--all', '--delivery', 'app-server-resume', '--transport', 'stdio'] ... L87: const file = path.join(home(), 'Library', 'LaunchAgents', 'com.greprag.codex-watch.plist'); L88: return { kind: 'macOS LaunchAgent', path: file, installed: fs.existsSync(file), hint: 'Load with launchctl or log out/in.' }; L89: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/codex-startup.jsView on unpkg · L45

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L24: name: 'Claude Code', L25: agentDir: path.join(home, '.claude'), L26: skillsTarget: path.join(home, '.claude', 'skills'), L27: docsTarget: path.join(home, '.claude', 'docs'), L28: refreshClaudeDocs: true, ... L31: name: 'Codex', L32: agentDir: path.join(home, '.codex'), L33: skillsTarget: path.join(home, '.codex', 'skills'), L34: docsTarget: path.join(home, '.codex', 'docs'), L35: refreshClaudeDocs: false, ... L39: function copyDir(src, dest) { L40: fs.mkdirSync(dest, { recursive: true }); Payload evidence from skill/content-advisor/SKILL.md: L1: --- L2: name: content-advisor

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L1

Source & flagged code

4 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "greprag",

3 "version": "5.65.0",

4 "description": "GrepRAG — agent memory for Claude Code, Codex, and OpenCode.",

5 "main": "dist/index.js",

6 "bin": {

7 "greprag": "dist/index.js",

8 "greprag-hook": "dist/hook.js"

9 },

10 "scripts": {

11 "build": "tsc && node scripts/bundle-opencode-plugin.mjs",

12 "clean": "rimraf dist",

13 "release:prepare": "npm run clean && npm run build && node scripts/verify-publish.cjs && node ../../tests/run-release-gate.cjs",

14 "prepublishOnly": "npm run release:prepare",

15 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "files": [

18 "dist",

19 "skill",

20 "scripts"

21 ],

22 "devDependencies": {

23 "@types/node": "^20.0.0",

24 "@types/sql.js": "^1.4.11",

25 "esbuild": "^0.17.19",

26 "rimraf": "^5.0.0",

27 "typescript": "^5.5.0"

28 },

29 "engines": {

30 "node": ">=18.0.0"

31 },

32 "keywords": [

33 "greprag",

34 "claude",

35 "codex",

dist/commands/codex-startup.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// Runs automatically after `npm install -g greprag`.

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L1

3//

4// Public UX contract:

5// * `greprag/` — the package's front-door skill. Always installed/refreshed

6// for detected Claude Code and Codex homes so users can type `/greprag`

7// immediately after installing the npm package.

8// * Other bundled skills — refresh-only. If the operator opted in earlier,