registry / sneakoscope / 10.5.8

sneakoscope@10.5.8

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The postinstall hook reaches guarded installation of the package’s own menu bar extension on qualifying systems. That is a lifecycle extension capability warranting a warning, but the inspected source does not establish a concrete malicious attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package globally with npm on macOS in an interactive, non-CI session, or setting the package’s menu bar opt-in environment flag.

Impact

The package’s own menu bar app may be installed and launched; no confirmed unrelated agent configuration or credential change was identified.

Mechanism

Postinstall calls a policy-gated function that invokes the package-owned menu bar installer.

AI rationale

Evidence

dist/cli/install-helpers.jsdist/cli/install-helpers-menubar.js

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook invokes the package’s installer command.
During postinstall, the package attempts to install its own menu bar app before checking the separate bootstrap opt-in.
Menu bar installation is gated to macOS and, by default, an interactive global npm install outside CI; environment flags can also enable it.
The menu bar installer is package-owned setup, and the reviewed source does not establish a broader agent control change.

Evidence against

Other postinstall mutations are gated by an explicit bootstrap environment opt-in.
The inspected source does not establish credential exfiltration or an unrelated consumer agent configuration write.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

60return new Promise((resolve) => { L61: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); L62: let stdoutTail = '';

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L60

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-bridge/server.jsView file

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto'; L2: import http, {} from 'node:http'; L3: import net, {} from 'node:net'; ... L36: const actual = createHash('sha256').update(capability).digest(); L37: const expected = Buffer.from(input.clientCapabilitySha256, 'hex'); L38: if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { ... L52: const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64'); L53: socket.write('HTTP/1.1 101 Switching Protocols\r\n' L54: + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

43const stubBin = path.join(tmp, 'bin'); L44: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L45: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L46: const npmUserConfig = path.join(tmp, 'npmrc'); ... L140: TMPDIR: runtimeTmp, L141: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L142: NODE_DISABLE_COMPILE_CACHE: '1', ... L166: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L167: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L168: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L320: try { L321: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L43

dist/core/daemon/sksd-hook-daemon.jsView file

259const entrypoint = fileURLToPath(new URL('./sk[redacted]', import.meta.url)); L260: const child = spawn(process.execPath, [entrypoint, root], { L261: detached: true, L262: stdio: 'ignore', L263: env: daemonSpawnEnv(process.env) L264: }); ... L274: return new Promise((resolve) => { L275: const socket = net.createConnection(socketPath); L276: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/daemon/sksd-hook-daemon.jsView on unpkg · L259

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/core/subagents/child-model-allowlist.jsView file

19Install-time code directly mutates a foreign AI-agent control surface: L19: const env = input.env || process.env; L20: return path.join(input.home || env.HOME || os.homedir(), '.codex', 'sks', OPENROUTER_ONLY_FILENAME); L21: } ... L219: const env = input.env || process.env; L220: const file = path.join(input.home || env.HOME || os.homedir(), '.codex', 'sks', 'sk[redacted]'); L221: try { Write operation from dist/core/fsx.js: L107: return; L108: const forbidden = path.join(path.resolve(realHome), '.codex'); L109: const target = path.resolve(p); ... L129: try { L130: await handle.writeFile(text, 'utf8'); L131: await handle.sync().catch(() => { }); ... L145: await ensureDir(path.dirname(p)); L146: await fsp.writeFile(p, text, { encoding: 'utf8', ...(requestedMode === null ? {} : { mode: reque

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/core/subagents/child-model-allowlist.jsView on unpkg · L19

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

1 Critical8 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/core/subagents/child-model-allowlist.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSame File Env Network Executiondist/core/daemon/sksd-hook-daemon.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Script

Affected versions and remediation

This report applies to sneakoscope@10.5.8.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.5.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 03:52:56.627Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code