registry / sneakoscope / 10.6.1

sneakoscope@10.6.1

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The postinstall menu bar setup is limited to interactive global installs on macOS, but still installs a platform extension without a separate setup command. This supports a warning for guarded extension lifecycle risk, not a finding of malicious attack behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package globally through an interactive npm session on macOS.

Impact

This can add and potentially start a first-party menu bar extension without a separate setup command, which presents a guarded extension lifecycle risk.

Mechanism

The postinstall path invokes the menu bar installer when its platform, global-install, and interactive-session conditions are met; it passes install and launch settings to that installer.

AI rationale

Evidence

package.jsondist/cli/install-helpers.jsdist/cli/install-helpers-menubar.js

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall command that invokes its own CLI.
Postinstall installs the menu bar app before checking the opt-in required for the remaining external setup.
On macOS, an interactive global npm install enables menu bar installation and may launch it.

Evidence against

Most postinstall external changes require SKS_POSTINSTALL_BOOTSTRAP=1, and the package otherwise returns without running that setup.
The inspected source does not establish credential transfer, destructive behavior, or an unguarded agent configuration change.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,241 file(s), 9.87 MB of source, external domains: 127.0.0.1, api.openai.com, bridge.invalid, chatgpt.com, developers.google.com, developers.openai.com, docs.getdesign.app, getdesign.md, github.com, invalid.codex-lb.local, lb.example.test, learn.chatgpt.com, llmstxt.org, mcp.context7.com, mcp.example.test, mcp.supabase.com, openrouter.ai, raw.githubusercontent.com, registry.npmjs.org, support.claude.com, www.apple.com, www.npmjs.com, www.sitemaps.org, www.w3.org

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

60return new Promise((resolve) => { L61: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); L62: let stdoutTail = '';

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L60

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-bridge/server.jsView file

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto'; L2: import http, {} from 'node:http'; L3: import net, {} from 'node:net'; ... L36: const actual = createHash('sha256').update(capability).digest(); L37: const expected = Buffer.from(input.clientCapabilitySha256, 'hex'); L38: if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { ... L52: const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64'); L53: socket.write('HTTP/1.1 101 Switching Protocols\r\n' L54: + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

43const stubBin = path.join(tmp, 'bin'); L44: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L45: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L46: const npmUserConfig = path.join(tmp, 'npmrc'); ... L140: TMPDIR: runtimeTmp, L141: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L142: NODE_DISABLE_COMPILE_CACHE: '1', ... L166: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L167: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L168: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L320: try { L321: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L43

dist/core/daemon/sksd-hook-daemon.jsView file

259const entrypoint = fileURLToPath(new URL('./sk[redacted]', import.meta.url)); L260: const child = spawn(process.execPath, [entrypoint, root], { L261: detached: true, L262: stdio: 'ignore', L263: env: daemonSpawnEnv(process.env) L264: }); ... L274: return new Promise((resolve) => { L275: const socket = net.createConnection(socketPath); L276: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/daemon/sksd-hook-daemon.jsView on unpkg · L259

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/core/subagents/child-model-allowlist.jsView file

19Install-time code directly mutates a foreign AI-agent control surface: L19: const env = input.env || process.env; L20: return path.join(input.home || env.HOME || os.homedir(), '.codex', 'sks', OPENROUTER_ONLY_FILENAME); L21: } ... L219: const env = input.env || process.env; L220: const file = path.join(input.home || env.HOME || os.homedir(), '.codex', 'sks', 'sk[redacted]'); L221: try { Write operation from dist/core/fsx.js: L107: return; L108: const forbidden = path.join(path.resolve(realHome), '.codex'); L109: const target = path.resolve(p); ... L129: try { L130: await handle.writeFile(text, 'utf8'); L131: await handle.sync().catch(() => { }); ... L145: await ensureDir(path.dirname(p)); L146: await fsp.writeFile(p, text, { encoding: 'utf8', ...(requestedMode === null ? {} : { mode: reque

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/core/subagents/child-model-allowlist.jsView on unpkg · L19

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

1 Critical8 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/core/subagents/child-model-allowlist.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSame File Env Network Executiondist/core/daemon/sksd-hook-daemon.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Script

Affected versions and remediation

This report applies to sneakoscope@10.6.1.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.6.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 11:33:19.115Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code