registry / spexcode / 0.2.7

spexcode@0.2.7

SpexCode — a spec-driven, self-developing dev tool. The `spex` CLI + spec server reads the .spec tree and its git history, and serves the dashboard.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs `spex init` or `spex materialize` in a target git project; configured agent hooks then receive lifecycle events.

Impact

A user who adopts the tool grants it persistent project-level integration with supported AI-agent control surfaces.

Mechanism

Explicit project-scoped AI-agent hook and trust materialization.

Rationale

Source inspection confirms explicit project-level Claude/Codex integration with lifecycle hooks and trust configuration, creating a real guarded control-surface risk. The static malicious label is overstated because no install-time foreign agent mutation, credential theft, remote payload execution, or exfiltration was found.

Evidence

package.jsonspec-cli/bin/spex.mjsspec-cli/src/init.tsspec-cli/src/materialize.tsspec-cli/src/plugin-harness.tsspec-cli/hooks/dispatch.shspec-cli/templates/spec/project/.config/core/idle/idle.sh.spec/spexcode.json.git/hooks/AGENTS.mdCLAUDE.md.claude/.codex/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`spec-cli/src/init.ts` invokes materialization after explicit `spex init`.
`spec-cli/src/materialize.ts` creates agent contracts, hook shims, and Codex trust.
`spec-cli/src/plugin-harness.ts` emits host-discovered plugin hooks.
`spec-cli/hooks/dispatch.sh` processes Claude/Codex lifecycle hook payloads.
`package.json` has a `postinstall` chmod operation on node-pty's helper.

Evidence against

`postinstall` only chmods `node_modules/node-pty/prebuilds/*/spawn-helper`; it does not write agent config or contact a network.
`spec-cli/bin/spex.mjs` runs only after the user invokes the `spex` binary.
Agent-control writes are reached through explicit `spex init` or `spex materialize`, not install-time.
No credential harvesting or external exfiltration endpoint was confirmed.
`spec-cli/templates/spec/project/.config/core/idle/idle.sh` is a readable session-state handler, not an encoded payload.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 1.80 MB of source, external domains: 127.0.0.1, pro.reactflow.dev, reactflow.dev, reactjs.org, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 12-46json

12 "!spec-cli/src/**/*.test.ts",

13 "spec-cli/bin",

14 "spec-cli/templates",

15 "spec-cli/hooks",

16 "spec-yatsu/src",

17 "!spec-yatsu/src/**/*.test.ts",

18 "spec-forge/src",

19 "!spec-forge/src/**/*.test.ts",

20 "spec-dashboard/dist",

21 "README.md"

22 ],

23 "engines": {

24 "node": ">=22"

25 },

26 "scripts": {

27 "api": "cd spec-cli && npm run serve",

28 "web": "cd spec-dashboard && npm run dev",

29 "lint": "cd spec-cli && npm run -s lint",

30 "hooks": "bash scripts/install-hooks.sh",

31 "prepack": "node scripts/prepack.mjs",

32 "postinstall": "node -e \"try{require('fs').readdirSync('node_modules/node-pty/prebuilds').forEach(d=>{try{require('fs').chmodSync('node_modules/node-pty/prebuilds/'+d+'/spawn-helper',0o755)}catch{}})}catch{}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L32

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@hono/node-server": "^1.13.7",

36 "@hono/node-ws": "^1.0.4",

37 "hono": "^4.6.14",

38 "node-pty": "^1.0.0",

39 "tsx": "^4.19.2"

40 },

41 "devDependencies": {

42 "@types/node": "^20.16.0",

43 "typescript": "^5.6.3"

44 }

45}

spec-yatsu/src/scenariofresh.tsView file

Lines 1-21typescript

1import { spawn } from 'node:child_process'

2import { git, gitA, headSha } from '../../spec-cli/src/git.js'

High

Child Process

Package source references child process execution.

spec-yatsu/src/scenariofresh.tsView on unpkg · L1

3import { parseScenarios } from './yatsu.js'

5// @@@ per-scenario content freshness — the SCENARIO axis, sub-file

6// A yatsu.md holds many scenarios, but a reading measures ONE. yatsu-core's contract says "a scenario is the

spec-cli/src/contract-filter.tsView file

Lines 74-114typescript

74case "$mode" in

75 clean) strip ;;

76 smudge)

77 if [ ! -r "$block" ]; then cat; exit 0; fi # no block content → identity (graceful, never fatal)

78 strip | awk -v b="$block" 'BEGIN { n = 0 }

spec-cli/src/boardDelta.tsView file

Lines 1-21typescript

1import { createHash } from 'node:crypto'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

spec-cli/src/boardDelta.tsView on unpkg · L1

3// @@@ board-delta — the pure core of the board's incremental push: decompose a board snapshot into a keyed

4// UNIT MAP, tag it, and diff two unit maps into a minimal {set, del} patch. The transport ([[board-stream]])

5// chains these patches over SSE (`from`/`to` tags) so a subscribed dashboard applies a few KB per change

6// instead of refetching the full ~600KB snapshot; the client-side mirror of apply/reconstruct lives in the

7// dashboard's data layer. Everything here is pure and synchronous — no fs, no git, no stream — so the

spec-forge/src/drivers/gitlab.tsView file

Lines 1-24typescript

1import { execFileSync } from 'node:child_process'

2import type { ForgeComment, ForgeDriver, ForgeIssue, ForgePR } from '../port.js'

4// @@@gitlab context — resolved once, lazily, from the repo the command runs in.

5// base + project come from `git remote get-url origin` (https://host/group/proj.git and

6// git@host:group/proj.git forms both collapse to { base: https://host, project: group/proj });

7// the token is never a config value: GITLAB_TOKEN env first, else git's own credential store

8// (`git credential fill` — the same place a push to that host already authenticates from).

spec-cli/hooks/harness.shView file

•path = spec-cli/hooks/harness.sh kind = build_helper sizeBytes = 13672 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

spec-cli/hooks/harness.shView on unpkg

spec-cli/templates/spec/project/.config/core/idle/idle.shView file

•path = spec-cli/templates/spec/project/.config/core/idle/idle.sh kind = payload_in_excluded_dir sizeBytes = 1163 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

spec-cli/templates/spec/project/.config/core/idle/idle.shView on unpkg

spec-cli/src/cli.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = spexcode@0.2.5 matchedIdentity = npm:c3BleGNvZGU:0.2.5 similarity = 0.764 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

spec-cli/src/cli.tsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('fs').readdirSync('node_modules/node-pty/prebuilds').forEach(d=>{try{require('fs').chmodSync('node_modules/node-pty/prebuilds/'+d+'/spawn-helper',0o755)}catch{...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

spec-yatsu/src/scenariofresh.tsView file

1import { spawn } from 'node:child_process' L2: import { git, gitA, headSha } from '../../spec-cli/src/git.js'

High

Child Process

Package source references child process execution.

spec-yatsu/src/scenariofresh.tsView on unpkg · L1

spec-cli/src/contract-filter.tsView file

94const filterCmd = (shim: string, mode: 'smudge' | 'clean') => L95: `sh -c 'test -r "$0" && exec bash "$0" ${mode} || exec cat' '${shim.replace(/'/g, `'\\''`)}'` L96:

High

Shell

Package source references shell execution.

spec-cli/src/contract-filter.tsView on unpkg · L94

spec-cli/src/boardDelta.tsView file

1import { createHash } from 'node:crypto' L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

spec-cli/src/boardDelta.tsView on unpkg · L1

spec-forge/src/drivers/gitlab.tsView file

4// @@@gitlab context — resolved once, lazily, from the repo the command runs in. L5: // base + project come from `git remote get-url origin` (https://host/group/proj.git and L6: // git@host:group/proj.git forms both collapse to { base: https://host, project: group/proj }); ... L13: if (ctx) return ctx L14: const remote = execFileSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf8' }).trim() L15: const parsed = parseRemote(remote) L16: if (!parsed) throw new Error(`gitlab: cannot parse origin remote '${remote}' as a GitLab URL`) L17: const token = process.env.GITLAB_TOKEN || credentialToken(parsed.host) L18: if (!token) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

spec-forge/src/drivers/gitlab.tsView on unpkg · L4

spec-cli/hooks/harness.shView file

•path = spec-cli/hooks/harness.sh kind = build_helper sizeBytes = 13672 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

spec-cli/hooks/harness.shView on unpkg

spec-cli/templates/spec/project/.config/core/idle/idle.shView file

•path = spec-cli/templates/spec/project/.config/core/idle/idle.sh kind = payload_in_excluded_dir sizeBytes = 1163 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

spec-cli/templates/spec/project/.config/core/idle/idle.shView on unpkg

spec-cli/src/cli.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

spec-cli/src/cli.tsView on unpkg

Findings

2 Critical5 High4 Medium7 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltaspec-cli/src/cli.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processspec-yatsu/src/scenariofresh.ts

HighShellspec-cli/src/contract-filter.ts

HighSame File Env Network Executionspec-forge/src/drivers/gitlab.ts

HighPayload In Excluded Dirspec-cli/templates/spec/project/.config/core/idle/idle.sh

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperspec-cli/hooks/harness.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptospec-cli/src/boardDelta.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 12-46json

12 "!spec-cli/src/**/*.test.ts",

13 "spec-cli/bin",

14 "spec-cli/templates",

15 "spec-cli/hooks",

16 "spec-yatsu/src",

17 "!spec-yatsu/src/**/*.test.ts",

18 "spec-forge/src",

19 "!spec-forge/src/**/*.test.ts",

20 "spec-dashboard/dist",

21 "README.md"

22 ],

23 "engines": {

24 "node": ">=22"

25 },

26 "scripts": {

27 "api": "cd spec-cli && npm run serve",

28 "web": "cd spec-dashboard && npm run dev",

29 "lint": "cd spec-cli && npm run -s lint",

30 "hooks": "bash scripts/install-hooks.sh",

31 "prepack": "node scripts/prepack.mjs",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L32

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@hono/node-server": "^1.13.7",

36 "@hono/node-ws": "^1.0.4",

37 "hono": "^4.6.14",

38 "node-pty": "^1.0.0",

39 "tsx": "^4.19.2"

40 },

41 "devDependencies": {

42 "@types/node": "^20.16.0",

43 "typescript": "^5.6.3"

44 }

45}

spec-yatsu/src/scenariofresh.tsView file

Lines 1-21typescript

1import { spawn } from 'node:child_process'

2import { git, gitA, headSha } from '../../spec-cli/src/git.js'

High

Child Process

Package source references child process execution.

spec-yatsu/src/scenariofresh.tsView on unpkg · L1

3import { parseScenarios } from './yatsu.js'

5// @@@ per-scenario content freshness — the SCENARIO axis, sub-file

6// A yatsu.md holds many scenarios, but a reading measures ONE. yatsu-core's contract says "a scenario is the

spec-cli/src/contract-filter.tsView file

Lines 74-114typescript

74case "$mode" in

75 clean) strip ;;

76 smudge)

77 if [ ! -r "$block" ]; then cat; exit 0; fi # no block content → identity (graceful, never fatal)

78 strip | awk -v b="$block" 'BEGIN { n = 0 }

spec-cli/src/boardDelta.tsView file

Lines 1-21typescript

1import { createHash } from 'node:crypto'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

spec-cli/src/boardDelta.tsView on unpkg · L1

3// @@@ board-delta — the pure core of the board's incremental push: decompose a board snapshot into a keyed

4// UNIT MAP, tag it, and diff two unit maps into a minimal {set, del} patch. The transport ([[board-stream]])

5// chains these patches over SSE (`from`/`to` tags) so a subscribed dashboard applies a few KB per change

6// instead of refetching the full ~600KB snapshot; the client-side mirror of apply/reconstruct lives in the

7// dashboard's data layer. Everything here is pure and synchronous — no fs, no git, no stream — so the

spec-forge/src/drivers/gitlab.tsView file

Lines 1-24typescript

1import { execFileSync } from 'node:child_process'

2import type { ForgeComment, ForgeDriver, ForgeIssue, ForgePR } from '../port.js'

4// @@@gitlab context — resolved once, lazily, from the repo the command runs in.

5// base + project come from `git remote get-url origin` (https://host/group/proj.git and

6// git@host:group/proj.git forms both collapse to { base: https://host, project: group/proj });

7// the token is never a config value: GITLAB_TOKEN env first, else git's own credential store

8// (`git credential fill` — the same place a push to that host already authenticates from).

spec-cli/hooks/harness.shView file

•path = spec-cli/hooks/harness.sh kind = build_helper sizeBytes = 13672 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

spec-cli/hooks/harness.shView on unpkg

spec-cli/templates/spec/project/.config/core/idle/idle.shView file

•path = spec-cli/templates/spec/project/.config/core/idle/idle.sh kind = payload_in_excluded_dir sizeBytes = 1163 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

spec-cli/templates/spec/project/.config/core/idle/idle.shView on unpkg

spec-cli/src/cli.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

spec-cli/src/cli.tsView on unpkg