registry / sneakoscope / 10.6.2

sneakoscope@10.6.2

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The postinstall hook can perform first-party Menu Bar setup before the separate bootstrap opt-in, including creating a persistent launch agent. The inspected runtime receiver parses provider events for compaction handling; no malicious behavior was established there.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Interactive global npm installation on macOS.

Impact

The package-owned app may run persistently after installation without a separate app setup command.

Mechanism

The postinstall helper runs the Menu Bar installer with changes enabled, which can create a launch agent configured to start at login and remain active.

AI rationale

Evidence

package.jsondist/cli/install-helpers.jsdist/cli/install-helpers-menubar.jsdist/core/codex-app/menubar/installer.jsdist/core/codex-app/menubar/launch-agent.js

Decision evidence

public snapshot

AI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall command invokes the installation helper.
Postinstall attempts Menu Bar setup before checking the separate bootstrap opt-in.
Automatic Menu Bar setup is limited to interactive global installs on macOS and runs the installer with apply enabled.
The installer creates a package-owned launch agent configured to run at load and stay alive.
The flagged runtime receiver parses provider event data, and its caller uses the parsed result as a compaction summary.

Evidence against

The broader postinstall bootstrap requires an affirmative opt-in.
The Menu Bar setup is gated by platform, global-install, CI, and terminal checks; no credential transfer or malicious action was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

14 flagged

package.jsonView file

Lines 78-118json

78 "runtime:no-src-mjs": "node ./dist/scripts/runtime-no-src-mjs-check.js",

79 "runtime:ts-source-of-truth": "node ./dist/scripts/runtime-ts-source-of-truth-check.js",

80 "architecture:guard": "node ./dist/scripts/architecture-guard-check.js",

81 "runtime:dist-parity": "node ./dist/scripts/runtime-dist-parity-check.js",

82 "release:check": "npm run release:check:affected",

83 "release:metadata": "node ./dist/scripts/release-metadata-check.js",

84 "release:version-truth": "node ./dist/scripts/release-version-truth-check.js",

85 "release:dist-freshness": "node ./dist/scripts/release-dist-freshness-check.js",

86 "release:provenance": "node ./dist/scripts/release-provenance-check.js",

87 "release:gate-script-parity": "node ./dist/scripts/release-gate-script-parity-check.js",

88 "release:file-ownership": "node ./dist/scripts/release-file-ownership-check.js",

89 "release:macos-menubar-proof": "node ./dist/scripts/release-macos-menubar-proof.js",

90 "release:main-push-guard": "node ./dist/scripts/release-main-push-guard.js",

91 "release:main-push-receipt": "node ./dist/scripts/release-main-push-receipt.js",

92 "release:pack-receipt": "node ./dist/scripts/release-pack-receipt.js",

93 "ppt:real-imagegen-wiring": "node ./dist/scripts/ppt-real-imagegen-wiring-check.js",

94 "ux-review:run-wires-imagegen": "node ./dist/scripts/ux-review-run-wires-imagegen-check.js",

95 "typecheck": "tsc -p tsconfig.json --noEmit",

96 "schema:check": "node ./dist/scripts/check-runtime-schemas.js",

97 "secret:preservation-guard": "node ./dist/scripts/secret-preservation-guard-check.js",

98 "postinstall": "node ./dist/bin/sks.js postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "blackbox:command-import-smoke": "node ./dist/scripts/blackbox-command-import-smoke.js",

100 "blackbox:pack-install": "node ./dist/scripts/blackbox-pack-install.js",

101 "blackbox:npx": "node ./dist/scripts/blackbox-npx-one-shot.js",

102 "blackbox:global-shim": "node ./dist/scripts/blackbox-global-shim.js",

103 "blackbox:matrix": "node ./dist/scripts/blackbox-matrix.js --real",

104 "blackbox:matrix:contract": "node ./dist/scripts/blackbox-matrix.js --contract",

105 "blackbox:check": "npm run blackbox:pack-install && npm run blackbox:npx && npm run blackbox:global-shim",

106 "postinstall:global-doctor-blackbox": "node ./dist/scripts/postinstall-global-doctor-blackbox.js",

107 "doctor:fix-production-blackbox": "node ./dist/scripts/doctor-fix-production-blackbox.js",

108 "doctor:startup-config-repair-blackbox": "node ./dist/scripts/doctor-startup-config-repair-blackbox.js",

109 "doctor:context7-mcp-repair-blackbox": "node ./dist/scripts/doctor-context7-mcp-repair-blackbox.js",

110 "doctor:supabase-mcp-repair-blackbox": "node ./dist/scripts/doctor-supabase-mcp-repair-blackbox.js",

111 "native-capability:postcheck": "node ./dist/scripts/native-capability-postcheck-check.js",

112 "runtime:ts-rust-boundary": "node ./dist/scripts/runtime-ts-rust-boundary-check.js",

113 "mcp:tool-naming-parity": "node ./dist/scripts/mcp-tool-naming-parity-check.js",

114 "runtime:terminal-current": "node ./dist/scripts/runtime-current-terminal-check.js",

115 "codex:project-config-policy-splitter": "node ./dist/scripts/codex-project-config-policy-splitter-check.js",

116 "migration:upgrade-safety": "node ./dist/scripts/current-upgrade-matrix-check.js",

117 "secret:supabase-preservation-blackbox": "node ./dist/scripts/supabase-secret-preservation-blackbox.js",

118 "update:preserves-supabase-keys": "node ./dist/scripts/update-preserves-supabase-keys-blackbox.js",

dist/core/codex/managed-proxy-env.jsView file

Lines 23-50javascript

23}

24export function detectManagedProxyEnv(env = process.env) {

25 const childEnv = managedProxyEnvForChild(env);

26 const redacted

dist/core/fsx.jsView file

Lines 1-25javascript

1import fs from 'node:fs';

2import fsp from 'node:fs/promises';

3import path from 'node:path';

4import os from 'node:os';

dist/core/release/release-gate-batch-runner.jsView file

Lines 40-80javascript

40 const result = await runOne(root, runId, reportRoot, gate);

41 results.push(result);

42 if (input.reportRoot)

43 writeChildResult(input.reportRoot, result);

44 }

dist/core/super-search/doctor.jsView file

Lines 64-97javascript

64 next_actions: diagnostics.next_actions,

65 evidence_paths: [...diagnostics.evidence_paths, ...(smoke || smokeFreshness.available ? [path.relative(process.cwd(), smokeReportPath)] : [])],

66 warnings: [...

dist/core/codex-lb/desktop-bridge/server.jsView file

Lines 1-21javascript

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto';

2import http, {} from 'node:http';

3import net, {} from 'node:net';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

Lines 23-63javascript

23 { argv: ['--agent', 'fixture', '--json'], expected_reason: 'unknown_command' },

24 { argv: ['--naruto', '--json'], expected_reason: 'unknown_command' },

dist/core/daemon/sksd-hook-daemon.jsView file

259const entrypoint = fileURLToPath(new URL('./sk[redacted]', import.meta.url)); L260: const child = spawn(process.execPath, [entrypoint, root], { L261: detached: true, L262: stdio: 'ignore', L263: env: daemonSpawnEnv(process.env) L264: }); ... L274: return new Promise((resolve) => { L275: const socket = net.createConnection(socketPath); L276: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/daemon/sksd-hook-daemon.jsView on unpkg · L259

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/core/subagents/child-model-allowlist.jsView file

19Install-time code directly mutates a foreign AI-agent control surface: L19: const env = input.env || process.env; L20: return path.join(input.home || env.HOME || os.homedir(), '.codex', 'sks', OPENROUTER_ONLY_FILENAME); L21: } ... L219: const env = input.env || process.env; L220: const file = path.join(input.home || env.HOME || os.homedir(), '.codex', 'sks', 'sk[redacted]'); L221: try { Write operation from dist/core/fsx.js: L107: return; L108: const forbidden = path.join(path.resolve(realHome), '.codex'); L109: const target = path.resolve(p); ... L129: try { L130: await handle.writeFile(text, 'utf8'); L131: await handle.sync().catch(() => { }); ... L145: await ensureDir(path.dirname(p)); L146: await fsp.writeFile(p, text, { encoding: 'utf8', ...(requestedMode === null ? {} : { mode: reque

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/core/subagents/child-model-allowlist.jsView on unpkg · L19

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

1 Critical8 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/core/subagents/child-model-allowlist.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSame File Env Network Executiondist/core/daemon/sksd-hook-daemon.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Script

Affected versions and remediation

This report applies to sneakoscope@10.6.2.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.6.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 06:17:08.367Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code