Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/cli.js:40
- Evidence
const result = spawnSync(process.execPath, args, { stdio: "inherit" });
Security audit
@psyb0t/codexbox
Security checks across malware telemetry and agentic risk
Overview
This package is a disclosed bridge to a user-run codexbox MCP server, but installing it gives that server file-operation and prompt-running powers through your agent.
Install only if you intend to let a self-hosted codexbox instance act on your agent's behalf, including reading, writing, and deleting files in the codexbox workspace. Point CODEXBOX_URL only at a server you control or trust, and treat CODEXBOX_MCP_MODE_TOKEN as sensitive.
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec