registry / Persistence / grix-connector / 4.0.2

grix-connector@4.0.2

Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Automatic postinstall deployment of an executable home-directory guardian is a meaningful persistence capability. Its scoped destination and absence of confirmed exfiltration support a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs postinstall; later Grix upgrade recovery invokes the helper.

Impact

This creates package-owned persistence and automatic package management outside the installation directory. No confirmed foreign agent-control mutation or credential export was found.

Mechanism

The hook copies and marks a shell guardian executable, which launches the global CLI and has an npm rollback branch.

AI rationale

Evidence

scripts/install-guardian.mjsscripts/upgrade-guardian.shpackage.json

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs an automatic postinstall script.
The postinstall script creates and overwrites an executable guardian under the user's Grix home directory.
The installed guardian can launch the globally installed package CLI and reinstall an earlier package release during its rollback path.

Evidence against

The install-time write is limited to the package's own .grix directory; no foreign AI-agent configuration write was established.
No credential collection or unrelated network export was identified in the inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 406 file(s), 2.77 MB of source, external domains: 127.0.0.1, antigravity.google, api.anthropic.com, api.deepseek.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.novita.ai, api.openai.com, api.siliconflow.cn, api.siliconflow.com, api.stepfun.ai, api.stepfun.com, api.z.ai, api2.cursor.sh, auth.kimi.com, auth.openai.com, brew.sh, chatgpt.com, cli.github.com, cli.kiro.dev, code.kimi.com, codewhisperer.us-east-1.amazonaws.com, curl.se, cursor.com, docs.anthropic.com, fnm.vercel.app, github.com, grix.dhf.pub, grix.internal, kiro.dev, moonshotai.github.io, nodejs.org, opencode.ai, openrouter.ai, qwen-code-assets.oss-cn-hangzhou.aliyuncs.com, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, schemas.microsoft.com, www.apple.com, www.npmjs.com

Source & flagged code

27 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "grix-connector": "dist/grix.js"

9 },

10 "files": [

11 "NOTICE",

12 "LICENSE",

13 "dist",

14 "!dist/**/*.map",

15 "!dist/**/*.d.ts",

16 "!dist/**/*.ts",

17 "openclaw-plugin",

18 "scripts/install-guardian.mjs",

19 "scripts/analyze-audit-replays.mjs",

20 "scripts/install-guardian.sh",

21 "scripts/upgrade-guardian.sh",

22 "openclaw.plugin.json"

23 ],

24 "scripts": {

25 "postinstall": "node scripts/install-guardian.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 "prepublishOnly": "npm run build:all",

27 "build": "npm run check:isolation && node -e \"const fs=require('fs'); for(const dir of ['dist/default-skills','dist/kimi-plugins']) fs.rmSync(dir,{recursive:true,force:true})\" && tsc && node -e \"const fs=require('fs'); for(const dir of ['default-skills','kimi-plugins']) fs.cpSync('src/'+dir,'dist/'+dir,{recursive:true,filter:s=>!s.endsWith('.ts')}); fs.cpSync('src/adapter/deepseek-harness/grix-jsonrpc.cordis.yml','dist/adapter/deepseek-harness/grix-jsonrpc.cordis.yml')\" && node scripts/build-dsh-bridge.mjs && node -e \"require('fs').cpSync('src/core/proxy/hermes-profile-relay.py','dist ...

28 "check:isolation": "node scripts/check-adapter-isolation.mjs",

29 "build:plugin": "node scripts/build-plugin.mjs",

30 "build:all": "npm run build && node scripts/minify-dist.mjs && npm run build:plugin",

31 "dev": "npm run build && node dist/grix.js",

32 "test": "node --experimental-vm-modules node_modules/vitest/vitest.mjs run",

33 "test:watch": "node --experimental-vm-modules node_modules/vitest/vitest.mjs",

34 "test:e2e": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e",

35 "test:e2e:smoke": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/smoke.test.ts",

36 "test:e2e:direct-relay": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/direct-relay-live.test.ts",

37 "test:e2e:codex-developer-instructions": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-developer-instructions-protocol.test.ts",

38 "test:e2e:claude-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/claude-audit-replay.test.ts",

39 "test:e2e:codex-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-audit-replay.test.ts",

40 "test:e2e:native-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts",

41 "test:e2e:kimi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts -t \"kimi:\"",

42 "test:e2e:kimi-question": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/kimi-acp-features.test.ts -t \"问答卡文本回执\"",

43 "test:e2e:pi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/pi-audit-replay.test.ts",

44 "test:e2e:reasonix-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/reasonix-audit-replay.test.ts",

45 "test:e2e:codewhale-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codewhale-audit-replay.test.ts",

Long lines were clipped for display.

openclaw-plugin/index.jsView file

Lines 2292-2332javascript

2292 warn(tag, msg, ...args) {

2293 if (!shouldLog(tag, "warn")) return;

2294 const line = formatLine("warn"

dist/core/util/cli-probe.jsView file

Lines 1-3javascript

1import{execFile as c}from"node:child_process";import{accessSync as b,constants as H,existsSync as A,statSync as T}from"node:fs";import{join as h,dirname as g,basename as $,delimiter

dist/core/mcp/internal-api-server.jsView file

Lines 1-2javascript

1import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from

dist/core/proxy/crypto/certificate.jsView file

Lines 1-6javascript

1import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFile as

dist/adapter/openhuman/openhuman-adapter.jsView file

Lines 1-11javascript

1import{EventEmitter as f}from"node:events";import{stat as _}from"node:fs/promises";import{mkdirSync as E}from"node:fs";import{homedir as u}from"node:os";

dist/core/provider-quota/kiro.jsView file

Lines 1-2javascript

1import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";

dist/core/installer/npm-registry.jsView file

Lines 1-5javascript

1import{execFile as E}from"node:child_process";import{promisify as x}from"node:util";import{log as b}from"../log/logger.js";import{probeUrls as $}from"./speed-test.js";

dist/adapter/claude/claude-adapter.jsView file

1Cross-file remote execution chain: dist/adapter/claude/claude-adapter.js spawns openclaw-plugin/index.js; helper contains network access plus dynamic code execution. L1: import{spawn as ee,spawnSync as te,execSync as ie,execFile as Qe}from"node:child_process";import{promisify as Ye}from"node:util";import{randomUUID as G}from"node:crypto";import{kil... L2: `):"No skills found",data:n}}catch(n){return{status:"failed",message:`Failed to scan skills: ${n instanceof Error?n.message:n}`}}if(!this.claudeProcess&&!this.claudePty)if(e==="com... L3: `)}finally{st(r)}}else this.claudeProcess?.stdin?.write(`${s} ... L5: `)}extractSingleTurnDelta(e){const t=e.trim();if(!t)return null;let i;try{i=JSON.parse(t)}catch{return o.warn("claude-adapter",`Single-turn fallback: dropping non-JSON stdout noise...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/adapter/claude/claude-adapter.jsView on unpkg · L1

dist/adapter/codex/codex-bridge.jsView file

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/adapter/codex/index.js -> dist/adapter/codex/codex-bridge.js L1: import{execFileSync as K}from"node:child_process";import{createInterface as me}from"node:readline";import{EventEmitter as Z}from"node:events";import{stat as Q}from"node:fs/promises... L2: \u2026(truncated)`,oe=80,et=120*1e3,tt=H("GRIX_CODEX_DELTA_COALESCE_MS",1e3),it=H("GRIX_CODEX_DELTA_COALESCE_CHARS",4096),st=[{id:"gpt-5.3-codex",displayName:"GPT-5.3 Codex",defaul... L3: `)})}catch{return!1}}getStatus(){return{alive:this.alive,busy:this.currentTurnId!==null||this.compacting,sessions:this.threadId?1:0}}getActiveEventIds(){return this.activeEventId?[...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/adapter/codex/codex-bridge.jsView on unpkg · L1

dist/core/proxy/hermes-profile-relay.pyView file

•path = dist/core/proxy/hermes-profile-relay.py kind = build_helper sizeBytes = 21893 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/core/proxy/hermes-profile-relay.pyView on unpkg

dist/assets/dsh-bridge/grix-dsh-bridge-4.0.2.tgzView file

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.0.2.tgz kind = high_entropy_blob sizeBytes = 22009 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.0.2.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.0.2.tgz kind = compressed_blob sizeBytes = 22009 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.0.2.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.0.2.tgz kind = nested_archive_needs_inspection sizeBytes = 22009 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/dsh-bridge/grix-dsh-bridge-4.0.2.tgzView on unpkg

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View on unpkg

dist/adapter/agy/agy-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/agy/agy-adapter.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High