codyx-ai@1.14.42

Analysis

Package codyx-ai@1.14.42 is a bootstrap for the "Codyx" coding-agent CLI. Its postinstall script resolves a platform-specific native binary from optionalDependencies (packages named codyx-ai-{platform}-{arch} covering 12 variants across linux, darwin, and windows on x64 and arm64) and writes it to a hardlinked location under bin/. On every CLI invocation via the codyx or cody commands, a launcher script spawns that binary, forwarding the user's command-line arguments. The JavaScript bootstrap code does not itself exfiltrate data or make network calls; the threat is in the platform-specific binary packages that are installed alongside it and executed on each run. When invoked, the native binary executes on the user's system with the full privileges of the calling user, inheriting stdin/stdout/stderr.