Loading npm security reports…

grix-connector@4.6.3: Malicious npm security report (Block) | LPM Firewall

registry / grix-connector / 4.6.3

grix-connector@4.6.3

Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation writes a persistent helper outside the package. At runtime, the Claude adapter weakens global Claude safety settings and trusts workspaces automatically; the service can also self-update from a server-selected version.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation, then starting a Claude-backed Grix session or receiving an upgrade response.

Impact

The package can remove Claude permission and workspace-trust safeguards, persist code outside its install directory, and replace itself with another release.

Mechanism

Persistent helper installation, AI-agent safety-setting mutation, and remote-directed self-update.

Attack narrative

On npm install, the package executes postinstall and overwrites persistent helper files under the user's Grix home. When its Claude adapter starts, it automatically trusts the selected workspace and sets Claude's global option to skip the dangerous-mode permission prompt. Separately, the running service asks its configured server for an upgrade version and globally installs another grix-connector release. Together these behaviors create persistence, weaken agent approval controls, and permit remote-directed replacement without a distinct user update command.

Rationale

The package performs concrete, unconsented persistence and broad AI-agent control-surface changes, then provides an automatic self-update path to another lifecycle-enabled release. These are not necessary passive connector operations and create a direct path to bypass user safeguards.

Evidence

package.jsonscripts/install-guardian.mjsdist/adapter/claude/claude-adapter.jsdist/core/upgrade/upgrade-checker.js

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-guardian.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

openclaw-plugin/index.jsView file

2312// src/audit/producer/ipc-audit-producer.ts L2313: import { fork } from "node:child_process"; L2314: import { randomUUID as randomUUID2 } from "node:crypto";

High

Child Process

Package source references child process execution.

openclaw-plugin/index.jsView on unpkg · L2312

3081} L3082: function buildExecApprovalResolveArgv(params) { L3083: const cliArgvPrefix = params.cliArgvPrefix && params.cliArgvPrefix.length > 0 ? params.cliArgvPrefix : resolveOpenClawCliArgvPrefix();

High

Shell

Package source references shell execution.

openclaw-plugin/index.jsView on unpkg · L3081

dist/core/mcp/internal-api-server.jsView file

1import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from"./t...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/mcp/internal-api-server.jsView on unpkg · L1

dist/core/proxy/crypto/certificate.jsView file

1import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFi... L2: `)??"";return`-----BEGIN ${e}-----

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/proxy/crypto/certificate.jsView on unpkg · L1

dist/core/upgrade/upgrade-checker.jsView file

1import{closeSync as O,existsSync as v,mkdirSync as C,openSync as me,readFileSync as P,realpathSync as we,renameSync as ve,writeFileSync as ye}from"node:fs";import{join as _,dirname... L2: --- ${o.to_version} crash note ---

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/upgrade/upgrade-checker.jsView on unpkg · L1

dist/core/provider-quota/kiro.jsView file

1import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";import{execFile as I}from"node:c...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/core/provider-quota/kiro.jsView on unpkg · L1

dist/core/installer/npm-registry.jsView file

1import{execFile as w,execFileSync as $}from"node:child_process";import{existsSync as O}from"node:fs";import{dirname as T,join as y}from"node:path";import{promisify as k}from"node:u... L2: [${n.label}] ${c}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/installer/npm-registry.jsView on unpkg · L1

dist/adapter/codex/codex-bridge.jsView file

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/adapter/codex/index.js -> dist/adapter/codex/codex-bridge.js L1: import{execFileSync as fe}from"node:child_process";import{createInterface as me}from"node:readline";import{EventEmitter as K}from"node:events";import{stat as Z}from"node:fs/promise... L2: \u2026(truncated)`,re=80,tt=120*1e3,it=60*1e3,st=300*1e3,nt=H("GRIX_CODEX_DELTA_COALESCE_MS",1e3),rt=H("GRIX_CODEX_DELTA_COALESCE_CHARS",4096),ot=[{id:"gpt-5.3-codex",displayName:"... L3: `)})}catch{return!1}}getStatus(){return{alive:this.alive,busy:this.currentTurnId!==null||this.compacting,sessions:this.threadId?1:0}}getActiveEventIds(){return this.activeEventId?[...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/adapter/codex/codex-bridge.jsView on unpkg · L1

dist/core/proxy/hermes-profile-relay.pyView file

•path = dist/core/proxy/hermes-profile-relay.py kind = build_helper sizeBytes = 21893 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/core/proxy/hermes-profile-relay.pyView on unpkg

dist/assets/dsh-bridge/grix-dsh-bridge-4.6.3.tgzView file

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.6.3.tgz kind = high_entropy_blob sizeBytes = 23091 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.6.3.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.6.3.tgz kind = compressed_blob sizeBytes = 23091 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.6.3.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.6.3.tgz kind = nested_archive_needs_inspection sizeBytes = 23091 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/dsh-bridge/grix-dsh-bridge-4.6.3.tgzView on unpkg

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View on unpkg

dist/adapter/claude/claude-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = grix-connector@4.6.5 matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.5 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapter/claude/claude-adapter.jsView on unpkg