registry / AI-agent capability abuse / grix-connector / 4.15.0

grix-connector@4.15.0

Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source confirms agent trust and permission safeguards can be changed automatically during user-started sessions. This warrants a warning for the residual capability; the inspected postinstall behavior installs the package’s own upgrade helper.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user starts an agent session through the connector.

Impact

Agent actions may proceed with fewer workspace trust checks or permission prompts.

Mechanism

The connector updates Claude and Codex trust settings and launches Cursor with trust and full-auto flags by default.

AI rationale

Evidence

dist/adapter/claude/claude-adapter.jsdist/adapter/codex/codex-bridge.jsdist/adapter/codex/codex-trust.jsdist/adapter/cursor/cursor-adapter.js.claude.json.claude/settings.jsonCodex config.toml

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall script copies this package’s upgrade guardian into the user’s Grix bin directory.
Starting a Claude session marks its workspace trusted and suppresses the user’s dangerous-mode permission prompt.
Codex startup calls an auto-trust helper that writes the project’s trusted level to Codex configuration.
Cursor launch defaults to trust and full-auto flags unless configured otherwise.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 495 file(s), 3.27 MB of source, external domains: 127.0.0.1, antigravity.google, api.anthropic.com, api.deepseek.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.novita.ai, api.openai.com, api.siliconflow.cn, api.siliconflow.com, api.stepfun.ai, api.stepfun.com, api.z.ai, api2.cursor.sh, astral.sh, auth.kimi.com, auth.openai.com, brew.sh, bun.sh, chatgpt.com, cli.github.com, cli.kiro.dev, code.kimi.com, codewhisperer.us-east-1.amazonaws.com, curl.se, cursor.com, docs.anthropic.com, fnm.vercel.app, github.com, grix.dhf.pub, grix.internal, hermes-agent.nousresearch.com, kiro.dev, moonshotai.github.io, nodejs.org, opencode.ai, openrouter.ai, qoder.com, qwen-code-assets.oss-cn-hangzhou.aliyuncs.com, qwenpaw.agentscope.io, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, rustup.rs, schemas.microsoft.com, sh.rustup.rs, static.qoder.com.cn, trae.cn, www.apple.com

Source & flagged code

25 flagged

package.jsonView file

Lines 8-48json

8 "grix-connector": "dist/grix.js"

9 },

10 "files": [

11 "NOTICE",

12 "LICENSE",

13 "docs/guide-acp-agent-integration.md",

14 "dist",

15 "!dist/**/*.map",

16 "!dist/**/*.d.ts",

17 "!dist/**/*.ts",

18 "openclaw-plugin",

19 "scripts/install-guardian.mjs",

20 "scripts/upgrade-guardian.mjs",

21 "scripts/launcher.mjs",

22 "scripts/analyze-audit-replays.mjs",

23 "scripts/install-guardian.sh",

24 "scripts/upgrade-guardian.sh",

25 "openclaw.plugin.json"

26 ],

27 "scripts": {

28 "postinstall": "node scripts/install-guardian.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

29 "prepublishOnly": "npm run build:all",

30 "build": "npm run check:isolation && node -e \"const fs=require('fs'); for(const dir of ['dist/default-skills','dist/kimi-plugins']) fs.rmSync(dir,{recursive:true,force:true})\" && tsc && node -e \"const fs=require('fs'); for(const dir of ['default-skills','kimi-plugins']) fs.cpSync('src/'+dir,'dist/'+dir,{recursive:true,filter:s=>!s.endsWith('.ts')}); fs.cpSync('src/adapter/deepseek-harness/grix-jsonrpc.cordis.yml','dist/adapter/deepseek-harness/grix-jsonrpc.cordis.yml')\" && node scripts/build-dsh-bridge.mjs && node -e \"require('fs').cpSync('src/core/proxy/hermes-profile-relay.py','dist ...

31 "check:isolation": "node scripts/check-adapter-isolation.mjs",

32 "build:plugin": "node scripts/build-plugin.mjs",

33 "build:all": "npm run build && node scripts/minify-dist.mjs && npm run build:plugin",

34 "dev": "npm run build && node dist/grix.js",

35 "test": "node --experimental-vm-modules node_modules/vitest/vitest.mjs run",

36 "test:watch": "node --experimental-vm-modules node_modules/vitest/vitest.mjs",

37 "test:e2e": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e",

38 "test:e2e:smoke": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/smoke.test.ts",

39 "test:e2e:direct-relay": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/direct-relay-live.test.ts",

40 "test:e2e:relay": "node scripts/relay-e2e.mjs",

41 "test:e2e:codex-developer-instructions": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-developer-instructions-protocol.test.ts",

42 "test:e2e:claude-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/claude-audit-replay.test.ts",

43 "test:e2e:codex-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-audit-replay.test.ts",

44 "test:e2e:native-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts",

45 "test:e2e:kimi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts -t \"kimi:\"",

46 "test:e2e:kimi-question": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/kimi-acp-features.test.ts -t \"问答卡文本回执\"",

47 "test:e2e:pi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/pi-audit-replay.test.ts",

48 "test:e2e:reasonix-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/reasonix-audit-replay.test.ts",

Long lines were clipped for display.

openclaw-plugin/index.jsView file

2450// src/audit/producer/ipc-audit-producer.ts L2451: import { fork } from "node:child_process"; L2452: import { randomUUID as randomUUID2 } from "node:crypto";

High

Child Process

Package source references child process execution.

openclaw-plugin/index.jsView on unpkg · L2450

dist/core/runtime/spawn.jsView file

Lines 1-3javascript

1import{accessSync as l,constants as w}from"node:fs";import{spawn as d,execSync as h}from"node:child_process";import{isAbsolute as P,join as m}from"node:path";const

dist/core/mcp/internal-api-server.jsView file

Lines 1-2javascript

1import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from

dist/core/proxy/crypto/certificate.jsView file

Lines 1-6javascript

1import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFile as

dist/core/upgrade/upgrade-checker.jsView file

Lines 1-4javascript

1import{closeSync as H,existsSync as w,mkdirSync as F,openSync as we,readFileSync as P,realpathSync as ve,renameSync as ye,writeFileSync as be}from"node:fs";import{join as v,dirname as Se}

dist/core/provider-quota/kiro.jsView file

Lines 1-2javascript

1import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";

dist/core/installer/npm-registry.jsView file

Lines 1-5javascript

1import{execFile as b,execFileSync as C}from"node:child_process";import{existsSync as $,mkdirSync as k}from"node:fs";import{basename as O,dirname as x,join as y}from"node:path"

dist/adapter/codex/codex-bridge.jsView file

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/adapter/codex/index.js -> dist/adapter/codex/codex-bridge.js L1: import{execFileSync as Te}from"node:child_process";import{createInterface as xe}from"node:readline";import{EventEmitter as ee}from"node:events";import{stat as te}from"node:fs/promi... L2: \u2026(truncated)`,le=80,ue=120*1e3,B=600*1e3,rt=60*1e3,ot=300*1e3,at=q("GRIX_CODEX_DELTA_COALESCE_MS",1e3),dt=q("GRIX_CODEX_DELTA_COALESCE_CHARS",4096),ct=[{id:"gpt-5.3-codex",dis... L3: `)})}catch{return!1}}getStatus(){return{alive:this.alive,busy:this.currentTurnId!==null||this.compacting,sessions:this.threadId?1:0}}getActiveEventIds(){return this.activeEventId?[...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/adapter/codex/codex-bridge.jsView on unpkg · L1

dist/core/proxy/hermes-profile-relay.pyView file

•path = dist/core/proxy/hermes-profile-relay.py kind = build_helper sizeBytes = 21893 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/core/proxy/hermes-profile-relay.pyView on unpkg

dist/assets/dsh-bridge/grix-dsh-bridge-4.15.0.tgzView file

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.15.0.tgz kind = high_entropy_blob sizeBytes = 24182 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.15.0.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.15.0.tgz kind = compressed_blob sizeBytes = 24182 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.15.0.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.15.0.tgz kind = nested_archive_needs_inspection sizeBytes = 24182 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/dsh-bridge/grix-dsh-bridge-4.15.0.tgzView on unpkg

dist/adapter/claude/mcp-http-launcher.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.9.5 matchedPath = dist/adapter/claude/mcp-http-launcher.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High