patch-codex-fast

Warn

Audited by Socket on Oct 4, 2026

3 alerts found:

Securityx2Anomaly
SecurityMEDIUM
scripts/codex_fast_patch/bundle.py

The fragment is a local JavaScript bundle patcher whose explicit behavior is to disable or bypass multiple authentication, entitlement, availability, and remote-access gates. It does not show conventional malware behaviors such as network exfiltration, credential theft, command execution, or destructive system changes. It nevertheless poses a significant integrity and authorization risk because it persistently rewrites application assets to defeat access controls. The omitted imported modules and pattern definitions require review for a complete assessment.

Confidence: 97%Severity: 78%
SecurityMEDIUM
scripts/codex_fast_patch/patterns.py

The fragment is a set of hardcoded patch rules designed to weaken Electron security protections and bypass authentication, model, and connector gates. It contains no direct execution or exfiltration in the supplied code, but its apparent purpose is unauthorized feature or access modification. Review any code that consumes these patterns, particularly bundle patching and Electron fuse configuration logic.

Confidence: 96%Severity: 78%
AnomalyLOW
scripts/codex_fast_patch/cli.py

The fragment is an administrative patcher that deliberately modifies a Codex Electron installation, disables Electron fuses, and re-signs the application. These actions create a meaningful integrity and security risk if the tool or its imported helpers are untrusted, but no direct malware behavior or data theft is evident in the provided code. Review the imported modules, especially patch_js, detect_paths, file-management functions, fuse operations, and signing helpers, before use. The shown fragment is syntactically incomplete at the end.

Confidence: 91%Severity: 62%
Audit Metadata
Analyzed At
Oct 4, 2026, 02:58 PM
Package URL
pkg:socket/skills-sh/crazymsn%2Fcodex-plugin%2Fpatch-codex-fast%2F@b88be9ae8cf11cf597cad24950edd3a0d205be98106ce3e1f7d4a2b376fa6242