registry / sneakoscope / 10.3.6

sneakoscope@10.3.6

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Postinstall installs and can launch the package's own menu bar and a persistent LaunchAgent on interactive global macOS installs before the bootstrap opt-in. That is first-party install-time agent setup with visible logs and opt-outs, so it is a warning rather than a hidden foreign control-surface hijack.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall on an interactive global macOS install when menu-bar opt-outs are unset.

Impact

A package-owned menu-bar process can be installed and kept alive across login without a separate bootstrap flag. It does not by itself rewrite Codex config or export credentials.

Mechanism

postinstall calls ensureSksMenuBarDuringPostinstall, which applies the menu-bar installer and writes a RunAtLoad KeepAlive LaunchAgent under the user Library/LaunchAgents directory.

AI rationale

Evidence

package.jsondist/cli/install-helpers.jsdist/cli/install-helpers-menubar.jsdist/core/codex-app/menubar/launch-agent.jsdist/core/codex-app/menubar/paths.js~/Library/LaunchAgents/com.sneakoscope.sks-menubar.plist

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

npm postinstall runs node ./dist/bin/sks.js postinstall.
That command installs the SKS menu bar before the SKS_POSTINSTALL_BOOTSTRAP gate.
On an interactive global macOS install the menu-bar policy defaults to install and launch.
The installer applies a user LaunchAgent with RunAtLoad and KeepAlive for com.sneakoscope.sks-menubar.
Broader Codex, HOME, and project bootstrap stays off unless SKS_POSTINSTALL_BOOTSTRAP=1.

Evidence against

Local, CI, non-macOS, and non-interactive installs skip the menu bar.
SKS_POSTINSTALL_NO_MENUBAR=1 and SKS_POSTINSTALL_NO_BOOTSTRAP=1 disable it.
The install prints a status line and is a first-party SKS app, not a hidden foreign agent config write.
Dependencies do not include sneakoscope itself, and this install path does not send credentials.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

60return new Promise((resolve) => { L61: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); L62: let stdoutTail = '';

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L60

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-bridge/server.jsView file

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto'; L2: import http, {} from 'node:http'; L3: import net, {} from 'node:net'; ... L35: const actual = createHash('sha256').update(capability).digest(); L36: const expected = Buffer.from(input.clientCapabilitySha256, 'hex'); L37: if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { ... L51: const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64'); L52: socket.write('HTTP/1.1 101 Switching Protocols\r\n' L53: + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

37const stubBin = path.join(tmp, 'bin'); L38: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L39: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L40: const npmUserConfig = path.join(tmp, 'npmrc'); ... L134: TMPDIR: runtimeTmp, L135: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L136: NODE_DISABLE_COMPILE_CACHE: '1', ... L160: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L161: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L162: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L314: try { L315: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L37

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/cli/command-manifest-lite.jsView file

11Install-time code directly mutates a foreign AI-agent control surface: L89: { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, L90: { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' }, L91: { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, Write operation from dist/cli/install-helpers.js: L153: await fsp.access(stamp).catch(async () => { L154: await fsp.writeFile(stamp, `${JSON.stringify(stampLib.buildStampPayload(), null, 2)}\n`); L155: console.log('SKS build stamp: restored inside the installed package for update self-verific

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/command-manifest-lite.jsView on unpkg · L11

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/scripts/check-runtime-schemas.jsView file

7const root = process.cwd(); L8: const tsc = spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['tsc', '-p', 'tsconfig.json', '--noEmit'], { L9: cwd: root,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/check-runtime-schemas.jsView on unpkg · L7

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/feature-fixture-runner.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/feature-fixture-runner.js#virtual:normalized:round1View on unpkg

dist/core/update/update-operation.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sneakoscope@10.3.3 matchedIdentity = npm:c25lYWtvc2NvcGU:10.3.3 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/update/update-operation.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

2 Critical8 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/cli/command-manifest-lite.js

CriticalPrevious Version Dangerous Deltadist/core/update/update-operation.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighRuntime Package Installdist/scripts/check-runtime-schemas.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/feature-fixture-runner.js#virtual:normalized:round1

Affected versions and remediation

This report applies to sneakoscope@10.3.6.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.3.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 07:06:25.210Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code