registry / lazycodex-ai / 4.14.1

lazycodex-ai@4.14.1

The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 279 file(s), 3.70 MB of source, external domains: 127.0.0.1, api.github.com, biomejs.dev, bun.sh, clangd.llvm.org, cli.github.com, clojure-lsp.io, deno.land, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, gleam.run, nodejs.org, posthog.com, registry.npmjs.org, sentry.io, us-assets.i.posthog.com, us.i.posthog.com, yandex.com, your-server.example.com

Oversized source lightweight scan

dist/cli/index.js2.85 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStrings127.0.0.1cli.github.comgithub.comyour-server.example.com

dist/cli-node/index.js2.80 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStrings127.0.0.1cli.github.comgithub.comyour-server.example.com

Source & flagged code

8 flagged

script/qa/web-terminal-visual-qa.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

script/qa/web-terminal-visual-qa.mjsView on unpkg · L1

4import { tmpdir } from "node:os";

5import { basename, join, resolve } from "node:path";

6import { pathToFileURL } from "node:url";

7import {

8 DEFAULT_TERMINAL_BACKGROUND,

9 DEFAULT_TERMINAL_FOREGROUND,

10 ansiColorCss,

11 escapeHtml,

12 renderAnsiToHtml,

13 stripAnsi,

14} from "./web-terminal-renderer.mjs";

15import {

16 BUILT_IN_REDACTION_RULE_COUNT,

17 compileRedactions,

18 redactEvidence,

19} from "./web-terminal-redaction.mjs";

21const HELP = `web-terminal-visual-qa

packages/lsp-tools-mcp/dist/tools.jsView file

Lines 468-508javascript

468 return pathValue.split(separator).filter(Boolean);

469}

470function getWindowsPathExtensions(env) {

471 const rawExtensions = env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD";

472 const extensions

packages/omo-codex/plugin/components/comment-checker/src/runner.tsView file

Lines 77-117typescript

77 return {

78 status: "error",

79 message,

80 binaryPath,

81 exitCode: result.exitCode,

82 stdout: result.stdout,

83 stderr: result.stderr,

84 };

85}

87export function

packages/lsp-daemon/dist/index.jsView file

Lines 1-22javascript

1// ../lsp-core/src/lsp/cleanup-errors.ts

2function reportBestEffortCleanupError(operation, error) {

3 if (process.env["CODEX_LSP_DEBUG_CLEANUP"] !== "1")

4 return;

5 const message = error instanceof Error

packages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1View file

•path = packages/omo-[redacted].ps1 kind = build_helper sizeBytes = 11504 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1View on unpkg

packages/omo-codex/plugin/components/lsp/test/fixtures/broken.pyView file

•path = packages/omo-[redacted].py kind = payload_in_excluded_dir sizeBytes = 15 magicHex = 76616c75653a20737472203d20310a

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/omo-codex/plugin/components/lsp/test/fixtures/broken.pyView on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 2940768 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 2940768 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg

Source & flagged code

8 flagged · loading source

script/qa/web-terminal-visual-qa.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

script/qa/web-terminal-visual-qa.mjsView on unpkg · L1

packages/lsp-tools-mcp/dist/tools.jsView file

488} L489: function createSpawnCommand(command, platform = process.platform, commandProcessor = process.env["ComSpec"] ?? "cmd.exe", env = process.env) { L490: const [cmd, ...args] = command;

High

Shell

Package source references shell execution.

packages/lsp-tools-mcp/dist/tools.jsView on unpkg · L488

packages/omo-codex/plugin/components/comment-checker/src/runner.tsView file

97try { L98: const require = createRequire(import.meta.url); L99: const packageExports: unknown = require(commentCheckerPackageName());

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/omo-codex/plugin/components/comment-checker/src/runner.tsView on unpkg · L97

packages/lsp-daemon/dist/index.jsView file

2Cross-file remote execution chain: packages/lsp-daemon/dist/index.js spawns packages/omo-[redacted].js; helper contains network access plus dynamic code execution. L2: function reportBestEffortCleanupError(operation, error) { L3: if (process.env["CODEX_LSP_DEBUG_CLEANUP"] !== "1") L4: return; ... L20: function contextCwd() { L21: return storage.getStore()?.cwd ?? process.cwd(); L22: } ... L59: root; L60: exitCode; L61: stderrTail; ... L202: handleData = (chunk) => { L203: const chunkBuffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf8"); L204: this.inputBuffer = Buffer.concat([this.inputBuffer, chunkBuffer]);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

packages/lsp-daemon/dist/index.jsView on unpkg · L2

packages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1View file

•path = packages/omo-[redacted].ps1 kind = build_helper sizeBytes = 11504 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1View on unpkg

packages/omo-codex/plugin/components/lsp/test/fixtures/broken.pyView file

•path = packages/omo-[redacted].py kind = payload_in_excluded_dir sizeBytes = 15 magicHex = 76616c75653a20737472203d20310a

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/omo-codex/plugin/components/lsp/test/fixtures/broken.pyView on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 2940768 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 2940768 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg

Findings

5 High6 Medium4 Low

HighChild Processscript/qa/web-terminal-visual-qa.mjs

HighShellpackages/lsp-tools-mcp/dist/tools.js

HighCross File Remote Execution Contextpackages/lsp-daemon/dist/index.js

HighPayload In Excluded Dirpackages/omo-codex/plugin/components/lsp/test/fixtures/broken.py

HighOversized Source Filedist/cli-node/index.js

MediumDynamic Requirepackages/omo-codex/plugin/components/comment-checker/src/runner.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpackages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1

MediumOversized Cli Entrypointdist/cli-node/index.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

8 flagged

script/qa/web-terminal-visual-qa.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

script/qa/web-terminal-visual-qa.mjsView on unpkg · L1

4import { tmpdir } from "node:os";

5import { basename, join, resolve } from "node:path";

6import { pathToFileURL } from "node:url";

7import {

8 DEFAULT_TERMINAL_BACKGROUND,

9 DEFAULT_TERMINAL_FOREGROUND,

10 ansiColorCss,

11 escapeHtml,

12 renderAnsiToHtml,

13 stripAnsi,

14} from "./web-terminal-renderer.mjs";

15import {

16 BUILT_IN_REDACTION_RULE_COUNT,

17 compileRedactions,

18 redactEvidence,

19} from "./web-terminal-redaction.mjs";

21const HELP = `web-terminal-visual-qa

packages/lsp-tools-mcp/dist/tools.jsView file

Lines 468-508javascript

468 return pathValue.split(separator).filter(Boolean);

469}

470function getWindowsPathExtensions(env) {

471 const rawExtensions = env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD";

472 const extensions

packages/omo-codex/plugin/components/comment-checker/src/runner.tsView file

Lines 77-117typescript

77 return {

78 status: "error",

79 message,

80 binaryPath,

81 exitCode: result.exitCode,

82 stdout: result.stdout,

83 stderr: result.stderr,

84 };

85}

87export function

packages/lsp-daemon/dist/index.jsView file

Lines 1-22javascript

1// ../lsp-core/src/lsp/cleanup-errors.ts

2function reportBestEffortCleanupError(operation, error) {

3 if (process.env["CODEX_LSP_DEBUG_CLEANUP"] !== "1")

4 return;

5 const message = error instanceof Error

packages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1View file

•path = packages/omo-[redacted].ps1 kind = build_helper sizeBytes = 11504 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1View on unpkg

packages/omo-codex/plugin/components/lsp/test/fixtures/broken.pyView file

•path = packages/omo-[redacted].py kind = payload_in_excluded_dir sizeBytes = 15 magicHex = 76616c75653a20737472203d20310a

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/omo-codex/plugin/components/lsp/test/fixtures/broken.pyView on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 2940768 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 2940768 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg