Loading npm security reports…

grix-connector@4.9.5: Malicious npm security report (Block) | LPM Firewall

registry / grix-connector / 4.9.5

grix-connector@4.9.5

Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically replaces executable guardian files in the user's Grix directory. Its daemon can later obtain a version from a remote service and globally install that same package release.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, followed by the connector daemon's automatic upgrade check.

Impact

A remote-selected release can run another lifecycle chain and replace the persistent Grix helper without a separate package-install action.

Mechanism

Install-time guardian replacement plus remote-directed self-upgrade.

Attack narrative

npm runs the postinstall hook, which creates the Grix bin directory and overwrites executable guardian helpers. Later, the service queries its configured Grix server for an upgrade version, then performs a global install of grix-connector at that version. That installation can invoke another release's lifecycle code, forming a remote-directed self-update chain outside a fresh user package-install decision.

AI rationale

The package combines an automatic lifecycle mutation with remote-directed installation of another release of itself. This is a concrete install-hook self-dependency chain with persistent executable replacement.

Evidence

package.jsonscripts/install-guardian.mjsdist/core/upgrade/upgrade-checker.jsdist/core/upgrade/npm-upgrader.js~/.grix/bin/upgrade-guardian.mjs~/.grix/bin/upgrade-guardian.fallback.mjs~/.grix/bin/upgrade-guardian.sh

Source & flagged code

26 flagged

package.jsonView file

Lines 7-47json

7 "bin": {

8 "grix-connector": "dist/grix.js"

9 },

10 "files": [

11 "NOTICE",

12 "LICENSE",

13 "dist",

14 "!dist/**/*.map",

15 "!dist/**/*.d.ts",

16 "!dist/**/*.ts",

17 "openclaw-plugin",

18 "scripts/install-guardian.mjs",

19 "scripts/upgrade-guardian.mjs",

20 "scripts/launcher.mjs",

21 "scripts/analyze-audit-replays.mjs",

22 "scripts/install-guardian.sh",

23 "scripts/upgrade-guardian.sh",

24 "openclaw.plugin.json"

25 ],

26 "scripts": {

27 "postinstall": "node scripts/install-guardian.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

28 "prepublishOnly": "npm run build:all",

29 "build": "npm run check:isolation && node -e \"const fs=require('fs'); for(const dir of ['dist/default-skills','dist/kimi-plugins']) fs.rmSync(dir,{recursive:true,force:true})\" && tsc && node -e \"const fs=require('fs'); for(const dir of ['default-skills','kimi-plugins']) fs.cpSync('src/'+dir,'dist/'+dir,{recursive:true,filter:s=>!s.endsWith('.ts')}); fs.cpSync('src/adapter/deepseek-harness/grix-jsonrpc.cordis.yml','dist/adapter/deepseek-harness/grix-jsonrpc.cordis.yml')\" && node scripts/build-dsh-bridge.mjs && node -e \"require('fs').cpSync('src/core/proxy/hermes-profile-relay.py','dist ...

30 "check:isolation": "node scripts/check-adapter-isolation.mjs",

31 "build:plugin": "node scripts/build-plugin.mjs",

32 "build:all": "npm run build && node scripts/minify-dist.mjs && npm run build:plugin",

33 "dev": "npm run build && node dist/grix.js",

34 "test": "node --experimental-vm-modules node_modules/vitest/vitest.mjs run",

35 "test:watch": "node --experimental-vm-modules node_modules/vitest/vitest.mjs",

36 "test:e2e": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e",

37 "test:e2e:smoke": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/smoke.test.ts",

38 "test:e2e:direct-relay": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/direct-relay-live.test.ts",

39 "test:e2e:relay": "node scripts/relay-e2e.mjs",

40 "test:e2e:codex-developer-instructions": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-developer-instructions-protocol.test.ts",

41 "test:e2e:claude-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/claude-audit-replay.test.ts",

42 "test:e2e:codex-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-audit-replay.test.ts",

43 "test:e2e:native-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts",

44 "test:e2e:kimi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts -t \"kimi:\"",

45 "test:e2e:kimi-question": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/kimi-acp-features.test.ts -t \"问答卡文本回执\"",

46 "test:e2e:pi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/pi-audit-replay.test.ts",

47 "test:e2e:reasonix-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/reasonix-audit-replay.test.ts",

Long lines were clipped for display.

openclaw-plugin/index.jsView file

Lines 2292-2332javascript

2292 warn(tag, msg, ...args) {

2293 if (!shouldLog(tag, "warn")) return;

2294 const line = formatLine("warn"

dist/core/mcp/internal-api-server.jsView file

Lines 1-2javascript

1import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from

dist/core/proxy/crypto/certificate.jsView file

Lines 1-6javascript

1import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFile as

dist/core/upgrade/upgrade-checker.jsView file

Lines 1-4javascript

1import{closeSync as H,existsSync as w,mkdirSync as F,openSync as we,readFileSync as P,realpathSync as ve,renameSync as ye,writeFileSync as be}from"node:fs";import{join as v,dirname as Se}from

dist/core/provider-quota/kiro.jsView file

Lines 1-2javascript

1import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";

dist/core/installer/npm-registry.jsView file

Lines 1-5javascript

1import{execFile as b,execFileSync as C}from"node:child_process";import{existsSync as $,mkdirSync as k}from"node:fs";import{basename as O,dirname as x,join as y}from"node:path"

dist/adapter/codex/codex-bridge.jsView file

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/adapter/codex/index.js -> dist/adapter/codex/codex-bridge.js L1: import{execFileSync as fe}from"node:child_process";import{createInterface as me}from"node:readline";import{EventEmitter as K}from"node:events";import{stat as Z}from"node:fs/promise... L2: \u2026(truncated)`,re=80,tt=120*1e3,it=60*1e3,st=300*1e3,nt=H("GRIX_CODEX_DELTA_COALESCE_MS",1e3),rt=H("GRIX_CODEX_DELTA_COALESCE_CHARS",4096),ot=[{id:"gpt-5.3-codex",displayName:"... L3: `)})}catch{return!1}}getStatus(){return{alive:this.alive,busy:this.currentTurnId!==null||this.compacting,sessions:this.threadId?1:0}}getActiveEventIds(){return this.activeEventId?[...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/adapter/codex/codex-bridge.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/adapter/codex/codex-bridge.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/codex/codex-bridge.jsView on unpkg

dist/core/proxy/hermes-profile-relay.pyView file

•path = dist/core/proxy/hermes-profile-relay.py kind = build_helper sizeBytes = 21893 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/core/proxy/hermes-profile-relay.pyView on unpkg

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView file

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgz kind = high_entropy_blob sizeBytes = 23133 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgz kind = compressed_blob sizeBytes = 23133 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgz kind = nested_archive_needs_inspection sizeBytes = 23133 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView on unpkg

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View on unpkg

dist/adapter/claude/claude-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/adapter/claude/claude-adapter.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/claude-adapter.jsView on unpkg

dist/adapter/agy/agy-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/adapter/agy/agy-adapter.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/agy/agy-adapter.jsView on unpkg

dist/adapter/agy/quota.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/adapter/agy/quota.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/agy/quota.jsView on unpkg

dist/adapter/claude/mcp-http-launcher.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/adapter/claude/mcp-http-launcher.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/mcp-http-launcher.jsView on unpkg

dist/core/installer/installer.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/core/installer/installer.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/installer/installer.jsView on unpkg

dist/core/installer/prereq-installer.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/core/installer/prereq-installer.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/installer/prereq-installer.jsView on unpkg

dist/core/proxy/hermes-profile-relay.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/core/proxy/hermes-profile-relay.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/proxy/hermes-profile-relay.jsView on unpkg

dist/core/runtime/spawn.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/core/runtime/spawn.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/spawn.jsView on unpkg

dist/core/upgrade/npm-upgrader.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/core/upgrade/npm[redacted] matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/upgrade/npm-upgrader.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-guardian.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

openclaw-plugin/index.jsView file

2312// src/audit/producer/ipc-audit-producer.ts L2313: import { fork } from "node:child_process"; L2314: import { randomUUID as randomUUID2 } from "node:crypto";

High

Child Process

Package source references child process execution.

openclaw-plugin/index.jsView on unpkg · L2312

3081} L3082: function buildExecApprovalResolveArgv(params) { L3083: const cliArgvPrefix = params.cliArgvPrefix && params.cliArgvPrefix.length > 0 ? params.cliArgvPrefix : resolveOpenClawCliArgvPrefix();

High

Shell

Package source references shell execution.

openclaw-plugin/index.jsView on unpkg · L3081

dist/core/mcp/internal-api-server.jsView file

1import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from"./t...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/mcp/internal-api-server.jsView on unpkg · L1

dist/core/proxy/crypto/certificate.jsView file

1import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFi... L2: `)??"";return`-----BEGIN ${e}-----

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/proxy/crypto/certificate.jsView on unpkg · L1

dist/core/upgrade/upgrade-checker.jsView file

1import{closeSync as H,existsSync as w,mkdirSync as F,openSync as we,readFileSync as P,realpathSync as ve,renameSync as ye,writeFileSync as be}from"node:fs";import{join as v,dirname... L2: --- ${o.to_version} crash note ---

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/upgrade/upgrade-checker.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/core/upgrade/upgrade-checker.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/upgrade/upgrade-checker.jsView on unpkg

dist/core/provider-quota/kiro.jsView file

1import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";import{execFile as I}from"node:c...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/core/provider-quota/kiro.jsView on unpkg · L1

dist/core/installer/npm-registry.jsView file

1import{execFile as b,execFileSync as C}from"node:child_process";import{existsSync as $,mkdirSync as k}from"node:fs";import{basename as O,dirname as x,join as y}from"node:path";impo... L2: [${o.label}] ${a}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/installer/npm-registry.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = grix-connector@4.11.1 matchedPath = dist/core/installer/npm[redacted] matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/installer/npm-registry.jsView on unpkg

dist/adapter/codex/codex-bridge.jsView file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/adapter/codex/codex-bridge.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/codex/codex-bridge.jsView on unpkg

dist/core/proxy/hermes-profile-relay.pyView file

•path = dist/core/proxy/hermes-profile-relay.py kind = build_helper sizeBytes = 21893 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/core/proxy/hermes-profile-relay.pyView on unpkg

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView file

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgz kind = high_entropy_blob sizeBytes = 23133 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgz kind = compressed_blob sizeBytes = 23133 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgz kind = nested_archive_needs_inspection sizeBytes = 23133 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/dsh-bridge/grix-dsh-bridge-4.9.5.tgzView on unpkg

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View on unpkg

dist/adapter/claude/claude-adapter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/claude-adapter.jsView on unpkg

dist/adapter/agy/agy-adapter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/agy/agy-adapter.jsView on unpkg

dist/adapter/agy/quota.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/agy/quota.jsView on unpkg

dist/adapter/claude/mcp-http-launcher.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/mcp-http-launcher.jsView on unpkg

dist/core/installer/installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/installer/installer.jsView on unpkg

dist/core/installer/prereq-installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/installer/prereq-installer.jsView on unpkg

dist/core/proxy/hermes-profile-relay.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/proxy/hermes-profile-relay.jsView on unpkg

dist/core/runtime/spawn.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/spawn.jsView on unpkg

dist/core/upgrade/npm-upgrader.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/upgrade/npm-upgrader.jsView on unpkg