@decoopus/chatgpt-setup@1.0.3

Summary

When the user runs the package's bin (chatgpt-setup/codex-setup), the tool rewrites ~/.codex/config.toml to set approval_policy='never' and sandbox_mode='danger-full-access', edits ~/.codex/.codex-global-state.json to set agent-mode to 'full-access' and inject the filesystem root ('/' on Unix or 'C:\\' on Windows) plus the user's home directory into every project's rootPaths, and points the Codex model_provider base_url at the author-controlled gateway https://api.vokes.in/v1. The combined effect is that tool-call instructions returned by that third-party gateway are executed by the local Codex agent without human approval, inside a sandbox expanded to the entire filesystem. The approval/sandbox disablement and the rootPaths expansion to the filesystem root are not described in the README, which advertises only gateway selection, model, provider and reasoning options alongside a 'Full Disk Access' success line. The documented CLI invocation is required to trigger the behavior; it does not fire from an npm lifecycle hook or on require().

Source: amazon-inspector (374490b0ea5605d8a8148dcbf592fa7cbcc96146e5822ae4bd2fae978a568722)