Loading npm security reports…
grix-connector@4.11.8: AI-agent capability abuse – flagged | LPM Firewall
Flagged as AI-agent capability risk
Allowed by default with warning: agent-facing configuration or capability changes need review before use.
grix-connector@4.11.8 Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.
scanned 27d ago · by lpm-firewall-ai The inspected source establishes concrete local AI-agent safeguard changes during adapter use, warranting a warning. It does not establish covert theft, remote payload execution, or unconsented install-time mutation of a broad foreign agent control surface.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the connector or starts an affected agent adapter.
Impact
These changes can reduce agent safeguards and expand an agent's ability to act in the selected workspace.
Mechanism
Adapters update Codex and Claude configuration and launch Cursor with trusted, MCP-approved, or full-auto options.
AI rationale
The inspected source establishes concrete local AI-agent safeguard changes during adapter use, warranting a warning. It does not establish covert theft, remote payload execution, or unconsented install-time mutation of a broad foreign agent control surface.
Evidence
dist/adapter/claude/claude-adapter.js dist/adapter/cursor/cursor-adapter.js dist/adapter/codex/codex-trust.js scripts/install-guardian.mjs
public snapshot AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
The package runs a postinstall guardian script. The installer creates a user-level Grix bin directory. The Claude adapter writes a setting that suppresses a dangerous-permission prompt. The Cursor adapter can enable trust, approve MCPs, and select a full-auto mode. The Codex adapter writes trusted-project entries to the user's Codex configuration. Evidence against
No credential collection, exfiltration sink, or unrelated network recipient was identified in the inspected evidence. The agent-setting changes are adapter behavior rather than postinstall agent-control-surface mutation. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified UrlStrings
Manifest
26 flagged · loading source • scripts.postinstall = node scripts/install-guardian.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg 2312 // src/audit/producer/ipc-audit-producer.ts
L2313: import { fork } from "node:child_process";
L2314: import { randomUUID as randomUUID2 } from "node:crypto";
High Child Process
Package source references child process execution.
openclaw-plugin/index.js View on unpkg · L2312 1 import{accessSync as w,constants as h}from"node:fs";import{spawn as d,execSync as P}from"node:child_process";import{isAbsolute as S,join as m}from"node:path";const $=process.platfo...
L2: `).forEach(s=>{const o=parseInt(s.trim(),10);!isNaN(o)&&o>0&&r.push(o)})}),n.on("close",()=>e(r)),n.on("error",()=>e([]))})}function I(t){return new Promise(e=>{const n=s=>{e(s.spl...
21 High 6 Medium 7 Low
High Install Time Lifecycle Scripts package.json
High Child Process openclaw-plugin/index.js
High Shell dist/core/runtime/spawn.js
High Same File Env Network Execution dist/core/upgrade/upgrade-checker.js
High Command Output Exfiltration dist/core/provider-quota/kiro.js
High Sandbox Evasion Gated Capability dist/core/installer/npm-registry.js
High Trigger Reachable Command Output Exfiltration dist/adapter/codex/codex-bridge.js
High Ships High Entropy Blob dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
High Semantic Analysis Limited dist/adapter/acp/acp-adapter.js#virtual:normalized:round1
High Known Malware Source Similarity dist/adapter/claude/claude-adapter.js
Affected versions and remediation This report applies to grix-connector@4.11.8 .
See all versions of grix-connector for other recorded verdicts.
Review the evidence and your use of grix-connector@4.11.8 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-26 03:59:48.610Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
91% Suspicious
AI assessment confidence
Package metadata npm Author askie
Maintainers askie
Version 4.11.8
Latest on npm 4.16.2
Published Sep 19, 2026
License Apache-2.0
Dependencies 13
Integrity verified
Package size 1000 KB
Files 548
Keywords grix aibot agent-connector claude codex gemini qwen deepseek
No manifest risk signals triggered.
scanned 483 file(s), 3.17 MB of source, external domains: 127.0.0.1, antigravity.google, api.anthropic.com, api.deepseek.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.novita.ai, api.openai.com, api.siliconflow.cn, api.siliconflow.com, api.stepfun.ai, api.stepfun.com, api.z.ai, api2.cursor.sh, astral.sh, auth.kimi.com, auth.openai.com, brew.sh, bun.sh, chatgpt.com, cli.github.com, cli.kiro.dev, code.kimi.com, codewhisperer.us-east-1.amazonaws.com, curl.se, cursor.com, docs.anthropic.com, fnm.vercel.app, github.com, grix.dhf.pub, grix.internal, kiro.dev, moonshotai.github.io, nodejs.org, opencode.ai, openrouter.ai, qoder.com, qwen-code-assets.oss-cn-hangzhou.aliyuncs.com, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, rustup.rs, schemas.microsoft.com, sh.rustup.rs, static.qoder.com.cn, trae.cn, www.apple.com, www.npmjs.com
High Shell
Package source references shell execution.
dist/core/runtime/spawn.js View on unpkg · L1 • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/runtime/spawn.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/runtime/spawn.js View on unpkg dist/core/mcp/internal-api-server.js View file 1 import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from"./t...
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/core/mcp/internal-api-server.js View on unpkg · L1 dist/core/proxy/crypto/certificate.js View file 1 import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFi...
L2: `)??"";return`-----BEGIN ${e}-----
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/core/proxy/crypto/certificate.js View on unpkg · L1 dist/core/upgrade/upgrade-checker.js View file 1 import{closeSync as H,existsSync as w,mkdirSync as F,openSync as we,readFileSync as P,realpathSync as ve,renameSync as ye,writeFileSync as be}from"node:fs";import{join as v,dirname...
L2: --- ${o.to_version} crash note ---
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/core/upgrade/upgrade-checker.js View on unpkg · L1 • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/upgrade/upgrade-checker.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/upgrade/upgrade-checker.js View on unpkg 1 import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";import{execFile as I}from"node:c...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/core/provider-quota/kiro.js View on unpkg · L1 1 import{execFile as b,execFileSync as C}from"node:child_process";import{existsSync as $,mkdirSync as k}from"node:fs";import{basename as O,dirname as x,join as y}from"node:path";impo...
L2: [${o.label}] ${a}
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/core/installer/npm-registry.js View on unpkg · L1 • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/installer/npm[redacted]
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/installer/npm-registry.js View on unpkg 1 Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/adapter/codex/index.js -> dist/adapter/codex/codex-bridge.js
L1: import{execFileSync as fe}from"node:child_process";import{createInterface as me}from"node:readline";import{EventEmitter as K}from"node:events";import{stat as Z}from"node:fs/promise...
L2: \u2026(truncated)`,re=80,tt=120*1e3,it=60*1e3,st=300*1e3,nt=H("GRIX_CODEX_DELTA_COALESCE_MS",1e3),rt=H("GRIX_CODEX_DELTA_COALESCE_CHARS",4096),ot=[{id:"gpt-5.3-codex",displayName:"...
L3: `)})}catch{return!1}}getStatus(){return{alive:this.alive,busy:this.currentTurnId!==null||this.compacting,sessions:this.threadId?1:0}}getActiveEventIds(){return this.activeEventId?[...
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/adapter/codex/codex-bridge.js View on unpkg · L1 • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/codex/codex-bridge.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/codex/codex-bridge.js View on unpkg dist/core/proxy/hermes-profile-relay.py View file • path = dist/core/proxy/hermes-profile-relay.py
kind = build_helper
sizeBytes = 21893
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/core/proxy/hermes-profile-relay.py View on unpkg dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View file • path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
kind = high_entropy_blob
sizeBytes = 23389
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View on unpkg • path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
kind = compressed_blob
sizeBytes = 23389
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View on unpkg • path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
kind = nested_archive_needs_inspection
sizeBytes = 23389
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View on unpkg dist/adapter/acp/acp-adapter.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/adapter/acp/acp-adapter.js#virtual:normalized:round1 View on unpkg dist/adapter/claude/claude-adapter.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/claude/claude-adapter.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/claude/claude-adapter.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/agy/agy-adapter.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/agy/agy-adapter.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/agy/quota.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/agy/quota.js View on unpkg dist/adapter/claude/mcp-http-launcher.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/claude/mcp-http-launcher.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/claude/mcp-http-launcher.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.11.1
matchedPath = dist/adapter/pi/pi-adapter.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/pi/pi-adapter.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/installer/installer.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/installer/installer.js View on unpkg dist/core/installer/prereq-installer.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.11.1
matchedPath = dist/core/installer/prereq-installer.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/installer/prereq-installer.js View on unpkg dist/core/proxy/hermes-profile-relay.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/proxy/hermes-profile-relay.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/proxy/hermes-profile-relay.js View on unpkg High
Known Malware Source Similarity
dist/adapter/codex/codex-bridge.js
High Known Malware Source Similarity dist/core/installer/npm-registry.js
High Known Malware Source Similarity dist/core/upgrade/upgrade-checker.js
High Known Malware Source Similarity dist/adapter/agy/agy-adapter.js
High Known Malware Source Similarity dist/adapter/agy/quota.js
High Known Malware Source Similarity dist/adapter/claude/mcp-http-launcher.js
High Known Malware Source Similarity dist/adapter/pi/pi-adapter.js
High Known Malware Source Similarity dist/core/installer/installer.js
High Known Malware Source Similarity dist/core/installer/prereq-installer.js
High Known Malware Source Similarity dist/core/proxy/hermes-profile-relay.js
High Known Malware Source Similarity dist/core/runtime/spawn.js
Medium Dynamic Require dist/core/mcp/internal-api-server.js
Medium Ships Build Helper dist/core/proxy/hermes-profile-relay.py
Medium Ships Compressed Blob dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/core/proxy/crypto/certificate.js
Low Nested Archive Needs Inspection dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
Runtime surface package.json Entrypoints main → dist/index.js types → ./dist/index.d.ts bin → grix-connector
Runtime node >=18.0.0
Artifact 3.48 MB · 548 files 2 signature(s)
Install lifecycle postinstall prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket HighEntropyStrings Minified UrlStrings Manifest: clean
26 flagged Lines 7-47 json
8 "grix-connector" : "dist/grix.js"
18 "scripts/install-guardian.mjs" ,
19 "scripts/upgrade-guardian.mjs" ,
20 "scripts/launcher.mjs" ,
21 "scripts/analyze-audit-replays.mjs" ,
22 "scripts/install-guardian.sh" ,
23 "scripts/upgrade-guardian.sh" ,
24 "openclaw.plugin.json"
27 "postinstall" : "node scripts/install-guardian.mjs" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L27 28 "prepublishOnly" : "npm run build:all" ,
29 "build" : "npm run check:isolation && node -e \" const fs=require('fs'); for(const dir of ['dist/default-skills','dist/kimi-plugins']) fs.rmSync(dir,{recursive:true,force:true}) \" && tsc && node -e \" const fs=require('fs'); for(const dir of ['default-skills','kimi-plugins']) fs.cpSync('src/'+dir,'dist/'+dir,{recursive:true,filter:s=>!s.endsWith('.ts')}); fs.cpSync('src/adapter/deepseek-harness/grix-jsonrpc.cordis.yml','dist/adapter/deepseek-harness/grix-jsonrpc.cordis.yml') \" && node scripts/build-dsh-bridge.mjs && node -e \" require('fs').cpSync('src/core/proxy/hermes-profile-relay.py','dist ...
30 " check:isolation ": " node scripts/check-adapter-isolation.mjs ",
31 " build:plugin ": " node scripts/build-plugin.mjs ",
32 " build:all ": " npm run build && node scripts/minify-dist.mjs && npm run build:plugin ",
33 " dev ": " npm run build && node dist/grix.js ",
34 " test ": " node --experimental-vm-modules node_modules/vitest/vitest.mjs run ",
35 " test:watch ": " node --experimental-vm-modules node_modules/vitest/vitest.mjs ",
36 " test:e 2 e ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e ",
37 " test:e 2 e:smoke ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e/smoke.test.ts ",
38 " test:e 2 e:direct-relay ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e/direct-relay-live.test.ts ",
39 " test:e 2 e:relay ": " node scripts/relay-e 2 e.mjs ",
40 " test:e 2 e:codex-developer-instructions ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e/codex-developer-instructions-protocol.test.ts ",
41 " test:e 2 e:claude-audit ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e/claude-audit-replay.test.ts ",
42 " test:e 2 e:codex-audit ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e/codex-audit-replay.test.ts ",
43 " test:e 2 e:native-audit ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e/native-event-audit-replay.test.ts ",
44 " test:e 2 e:kimi-audit ": " RUN_REAL_AGENT_E 2 E= 1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e 2 e/native-event-audit-replay.test.ts -t \ "kimi: \" " ,
45 "test:e2e:kimi-question" : "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/kimi-acp-features.test.ts -t \" 问答卡文本回执 \" " ,
46 "test:e2e:pi-audit" : "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/pi-audit-replay.test.ts" ,
47 "test:e2e:reasonix-audit" : "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/reasonix-audit-replay.test.ts" ,
Long lines were clipped for display.
Lines 2292-2332 javascript
2292 warn (tag, msg, ... args) {
2293 if ( ! shouldLog (tag, "warn" )) return ;
2294 const line = formatLine ( "warn"
Lines 1-3 javascript
1 import {accessSync as w,constants as h} from "node:fs" ; import {spawn as d,execSync as P} from "node:child_process" ; import {isAbsolute as S,join as m} from "node:path" ; const
dist/core/mcp/internal-api-server.js View file Lines 1-2 javascript
1 import B from "node:http" ; import {randomBytes as M} from "node:crypto" ; import {log as h} from "../log/index.js" ; import {PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P} from
dist/core/proxy/crypto/certificate.js View file Lines 1-6 javascript
1 import {createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z} from "node:crypto" ; import {existsSync as b} from "node:fs" ; import {mkdir as J,readFile as
dist/core/upgrade/upgrade-checker.js View file Lines 1-4 javascript
1 import {closeSync as H,existsSync as w,mkdirSync as F,openSync as we,readFileSync as P,realpathSync as ve,renameSync as ye,writeFileSync as be} from "node:fs" ; import {join as v,dirname as Se}
Lines 1-2 javascript
1 import {readFile as _} from "node:fs/promises" ; import {existsSync as m} from "node:fs" ; import {homedir as h} from "node:os" ; import {join as u} from "node:path" ;
Lines 1-5 javascript
1 import {execFile as b,execFileSync as C} from "node:child_process" ; import {existsSync as $,mkdirSync as k} from "node:fs" ; import {basename as O,dirname as x,join as y} from "node:path"
1 Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/adapter/codex/index.js -> dist/adapter/codex/codex-bridge.js
L1: import{execFileSync as fe}from"node:child_process";import{createInterface as me}from"node:readline";import{EventEmitter as K}from"node:events";import{stat as Z}from"node:fs/promise...
L2: \u2026(truncated)`,re=80,tt=120*1e3,it=60*1e3,st=300*1e3,nt=H("GRIX_CODEX_DELTA_COALESCE_MS",1e3),rt=H("GRIX_CODEX_DELTA_COALESCE_CHARS",4096),ot=[{id:"gpt-5.3-codex",displayName:"...
L3: `)})}catch{return!1}}getStatus(){return{alive:this.alive,busy:this.currentTurnId!==null||this.compacting,sessions:this.threadId?1:0}}getActiveEventIds(){return this.activeEventId?[...
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/adapter/codex/codex-bridge.js View on unpkg · L1 • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/codex/codex-bridge.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/codex/codex-bridge.js View on unpkg dist/core/proxy/hermes-profile-relay.py View file • path = dist/core/proxy/hermes-profile-relay.py
kind = build_helper
sizeBytes = 21893
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/core/proxy/hermes-profile-relay.py View on unpkg dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View file • path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
kind = high_entropy_blob
sizeBytes = 23389
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View on unpkg • path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
kind = compressed_blob
sizeBytes = 23389
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View on unpkg • path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz
kind = nested_archive_needs_inspection
sizeBytes = 23389
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/assets/dsh-bridge/grix-dsh-bridge-4.11.8.tgz View on unpkg dist/adapter/acp/acp-adapter.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/adapter/acp/acp-adapter.js#virtual:normalized:round1 View on unpkg dist/adapter/claude/claude-adapter.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/claude/claude-adapter.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/claude/claude-adapter.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/agy/agy-adapter.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/agy/agy-adapter.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/agy/quota.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/agy/quota.js View on unpkg dist/adapter/claude/mcp-http-launcher.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/adapter/claude/mcp-http-launcher.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/claude/mcp-http-launcher.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.11.1
matchedPath = dist/adapter/pi/pi-adapter.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/adapter/pi/pi-adapter.js View on unpkg • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/installer/installer.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/installer/installer.js View on unpkg dist/core/installer/prereq-installer.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.11.1
matchedPath = dist/core/installer/prereq-installer.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/installer/prereq-installer.js View on unpkg dist/core/proxy/hermes-profile-relay.js View file • matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/proxy/hermes-profile-relay.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/proxy/hermes-profile-relay.js View on unpkg , tag, msg, args);
2295 emitConsole ( "warn" , line);
2296 safeWrite (line + " \n " );
2298 error (tag, msg, ... args) {
2299 if ( ! shouldLog (tag, "error" )) return ;
2300 const line = formatLine ( "error" , tag, msg, args);
2301 emitConsole ( "error" , line);
2302 safeWrite (line + " \n " );
2306 // src/core/log/rotation.ts
2307 var DEFAULT_LOG_MAX_BYTES = 10 * 1024 * 1024 ;
2309 // src/core/log/packet-log.ts
2310 var DEFAULT_MAX_BYTES = 128 * 1024 * 1024 ;
2312 // src/audit/producer/ipc-audit-producer.ts
2313 import { fork } from "node:child_process" ;
2314 import { randomUUID as randomUUID2 } from "node:crypto" ;
High Child Process
Package source references child process execution.
openclaw-plugin/index.js View on unpkg · L2312 2315 import { fileURLToPath } from "node:url" ;
2317 // src/audit/worker/audit-recorder-ipc-protocol.ts
2318 var AUDIT_RECORDER_PROTOCOL_VERSION = 3 ;
2319 function isAuditRecorderChildMessage ( value ) {
2320 if ( ! isRecord (value) || typeof value.type !== "string" ) return false ;
2321 switch (value.type) {
2322 case "audit_recorder_ready" :
2323 return value.protocolVersion === AUDIT_RECORDER_PROTOCOL_VERSION ;
2324 case "audit_recorder_job_result" :
2325 return typeof value.deliveryId === "string" && typeof value.ok === "boolean" && typeof value.retryable === "boolean" && (value.error === void 0 || typeof value.error === "string" ) && (value.revision === void 0 || typeof value.revision === "number" && Number. isSafeInteger (value.revision) && value.revision > 0 ) && (value.quality === void 0 || value.quality === "complete" || value.quality === "partial" || value.quality === "metadata_only" || value.quality === "failed" ) && (value.truncated === void 0 || typeof value.truncated === "boolean" );
2326 case "audit_recorder_flushed" :
2327 case "audit_recorder_stopped" :
2328 return typeof value.requestId === "string" ;
2329 case "audit_recorder_fatal" :
2330 return typeof value.error === "string" ;
$
=
process.platform
===
"win32"
?
";"
:
":"
;
function
x
(
t
){
try
{
return
w
(t,h.
X_OK
),
!
0
}
catch
{
return!
1
}}
function
H
(
t
,
e
){
const
n
=
String
(t
??
""
).
trim
();
if
(
!
n
||
S
(n))
return
n;
const
r
=
process.platform
===
"win32"
,
i
=
String
(e
??
process.env.
PATH
??
""
),
s
=
[],
o
=new
Set;
for
(
const
c
of
i.
split
($)){
const
a
=
c.
trim
();
if
(
!
a)
continue
;
if
(r){
const
u
=
m
(a,n
+
".cmd"
);o.
has
(u)
||
(o.
add
(u),s.
push
(u))}
const
p
=
m
(a,n);o.
has
(p)
||
(o.
add
(p),s.
push
(p))}
for
(
const
c
of
s)
if
(
x
(c))retu
...
2 `).forEach(s=>{const o=parseInt(s.trim(),10);!isNaN(o)&&o>0&&r.push(o)})}),n.on("close",()=>e(r)),n.on("error",()=>e([]))})}function I(t){return new Promise(e=>{const n=s=>{e(s.split(/ \r ? \n /).map(o=>parseInt(o.trim(),10)).filter(o=>!isNaN(o)&&o>0))},r=d("wmic",["process","where",` (ParentProcessId = ${t}) `,"get","ProcessId"],{stdio:"pipe",windowsHide:!0});let i="";r.stdout?.on("data",s=>{i+=s.toString()}),r.on("close",s=>{if(s===0){n(i);return}l(t).then(e)}),r.on("error",()=>{l(t).then(e)})})}function l(t){return new Promise(e=>{const n=` ${process.env.SystemRoot || "C: \\ Windows" }\\System32\\Windows ...
High Shell
Package source references shell execution.
dist/core/runtime/spawn.js View on unpkg · L1 Long lines were clipped for display.
• matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/runtime/spawn.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/runtime/spawn.js View on unpkg "./tools.js"
;
import
{WebSocketServer
as
R,WebSocket
as
$}
from
"ws"
;
const
y
=
1024
*
1024
,
_
=
32
*
1024
*
1024
,
N
=
50
,
k
=
1e3
,
f
=
75e3
,
H
=
"2024-11-05"
,
U
=
256
,
T
=new
Set
([
...
C
,
"event_tool_call"
,
"mcp_stdio_log"
]);
class
W
{
server
=
null
;
port
=
0
;
authToken
;
invokeHandler
=
null
;
statusLineHandler
=
null
;
otelHandler
=
null
;
activeInvokes
=
0
;
wss
=
null
;
bridgeWs
=
null
;
mcpBridgeUpHandler
=
null
;
downstreamOutbox
=
[];
mcpBridgeHttpActive
=!
1
;
pendingBridgeResponses
=new
Map;co
...
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/core/mcp/internal-api-server.js View on unpkg · L1 Long lines were clipped for display.
Z,writeFile
as
T}
from
"node:fs/promises"
;
import
{isIP
as
q}
from
"node:net"
;
import
{join
as
_}
from
"node:path"
;
import
{createSecureContext
as
W}
from
"node:tls"
;
const
X
=
"root-ca-cert.pem"
,
Q
=
"root-ca-key.pem"
,
p
=
"Grix Proxy Root CA"
,
v
=
30
,
ee
=
3650
,
C
=
2048
,
te
=
"1.3.6.1.5.5.7.3.1"
,
re
=
"1.2.840.113549.1.1.11"
,
ne
=
"2.5.4.3"
,
B
=
"2.5.29.19"
,
E
=
"2.5.29.15"
,
oe
=
"2.5.29.37"
,
ie
=
"2.5.29.17"
,
D
=
"2.5.29.14"
,
ce
=
"2.5.29.35"
;
function
fe
(
e
){
if
(e
<
12
...
2 `)??"";return` ----- BEGIN ${e} -----
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/core/proxy/crypto/certificate.js View on unpkg · L1 5 `}function h(e){const t=e.export({format:"der",type:"spki"});return x("sha1").update(t).digest()}function R(){const e=x("sha256").update(Buffer.from(` ${Date.now()} - ${Math.random()} `)).digest().subarray(0,16);return e[0]=(e[0]??0)&127,e}function k(e,t){return new Date(e.getTime()+t*24*60*60*1e3)}function Y(e){return o(N(e))}function j(e){const t=e.length===0?0:Math.max(...e),r=Math.floor(t/8)+1,n=Buffer.alloc(Math.max(r,1),0);for(const i of e){const s=Math.floor(i/8),c=7-i%8;n[s]=(n[s]??0)|1<<c}return K(n)}function de(e){return o(...e.map(t=>S(t)))}function ge(e){return o(l(0,e))}function F(e){ ...
Long lines were clipped for display.
from
"node:path"
;
import
{spawn
as
x}
from
"node:child_process"
;
import
{log
as
y}
from
"../log/index.js"
;
import
{GRIX_PATHS
as
b}
from
"../log/index.js"
;
import
{resolveClientVersion
as
T}
from
"../util/client-version.js"
;
import
{UpgradeError
as
E,armWindowsUpgradeHandoff
as
q,archivePendingJournal
as
Re,armWindowsUpgradeRollback
as
Ee,cleanupPendingBackup
as
B,collectEnvInfo
as
Te,discardPendingStaging
as
N,finalizePendingTr ...
2 --- ${o.to_version} crash note ---
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/core/upgrade/upgrade-checker.js View on unpkg · L1 3 ${g} `:"")}}else if(i&&i.to_version===r&&$(t,"current")===r){a(` daemon startup: running switched target ${r}, upgrade succeeded `);const l=await this.confirmHealthz(ce);a(l?"healthz confirmed healthy, reporting success":"healthz not confirmed within window; reporting success on version-match"),f={from_version:i.from_version,to_version:i.to_version,status:"success"}}else if(i&&i.from_version===r&&i.switched===!1){a(` daemon startup: switch record for ${i.to_version} was never applied; discarding `);try{R(O(t),{force:!0})}catch{}try{R(L(t),{force:!0})}catch{}return}else if(i&&i.from_version===r)a(` d ...
Long lines were clipped for display.
• matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/upgrade/upgrade-checker.js
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/upgrade/upgrade-checker.js View on unpkg import
{execFile
as
I}
from
"node:child_process"
;
import
{promisify
as
O}
from
"node:util"
;
const
f
=
O
(
I
),
N
=
[
u
(
h
(),
".aws/sso/cache/kiro-auth-token-cli.json"
),
u
(
h
(),
".aws/sso/cache/kiro-auth-token.json"
)],
R
=
"https://codewhisperer.us-east-1.amazonaws.com"
,
b
=
"AmazonCodeWhispererService.GetUsageLimits"
,
S
=
1e4
,
E
=
"kirocli:odic:token"
,
C
=
"kirocli:odic:device-registration"
;
async
function
x
(
t
){
try
{
const
{
stdout
:
r
}
=await
f
(
"security"
,[
"find-generic-password"
,
"-s"
,t,
"-w"
...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/core/provider-quota/kiro.js View on unpkg · L1 Long lines were clipped for display.
;
import
{promisify
as
A}
from
"node:util"
;
import
{resolveRuntimePaths
as
P}
from
"../config/paths.js"
;
import
{log
as
I}
from
"../log/logger.js"
;
import
{probeUrls
as
D}
from
"./speed-test.js"
;
const
M
=
A
(b),
U
=
1e4
,
N
=
2
,
j
=
3e3
;
function
L
(
e
){
if
(
!
e)
return!
1
;
const
t
=
e.
replace
(
/
\\
/
g
,
"/"
).
toLowerCase
();
return
O
(t)
===
"npm-cli.js"
||
t.
includes
(
"/node_modules/npm/"
)}
function
F
(){
try
{
const
e
=
y
(
P
().rootDir,
"npm-cache"
);
return
k
(e,{recursive:
!
0
}),e}cat
...
2 [${o.label}] ${a}
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/core/installer/npm-registry.js View on unpkg · L1 3 ${f} `.trim(),r),I.info("installer",` ${o.label} failed : ${a. slice ( 0 , 200 )} `),K(a)&&s<N){await new Promise(d=>setTimeout(d,j));continue}if(!H(a))throw new T(a,c);break}throw new T(` npm install failed on all registries. Last error : ${u} `,c)}function H(e){return/ECONNRESET|ETIMEDOUT|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|ERR_SOCKET_TIMEOUT|getaddrinfo|socket hang up|network|fetch failed|timed out|tunneling socket|self.signed|404|ETARGET|No matching version|notarget/i.test(e)}function K(e){return/ \b EBUSY \b |resource busy or locked|EPERM[^ \n ]* \b rename \b | \b ELOCKED \b /i.test(e)}function W(e,t,r,i,n){return new ...
4 ${ S ?? ""}` . trim (); if (m){ const w = h || m.message, v = f || m.killed ===! 0 ? `ETIMEDOUT: npm install exceeded ${ r }ms (registry likely unreachable): ${ w }` : w; c ( new T (v,h || w)); return } u (h)}); E = setTimeout (() => {f =! 0 ,l && g.pid ? d =new Promise ( m => { b ( "taskkill" ,[ "/PID" , String (g.pid), "/T" , "/F" ],{windowsHide: ! 0 ,timeout: 1e4 },() => {g. kill ( "SIGTERM" ), m ()})}) : g. kill ( "SIGTERM" )},r), E . unref ?.()})} function Y ( e ){ if (e &&typeof e == "object" && "output" in e){ const t = e.output; return typeof t == "string" ? t : "" } return "" } function z ( e , t ){ return e. length <= t ? e : e. slice ( - t)} function ne ( e ){ return p. map ( t => ({label:t.label,command: `npm install -g ${ e } ...
Long lines were clipped for display.
• matchType = normalized_sha256
matchedPackage = grix-connector@4.9.5
matchedPath = dist/core/installer/npm[redacted]
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/installer/npm-registry.js View on unpkg