@abox-dev/cli@0.1.6

CLI for AgentBox sandboxes and templates

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a user-invoked AgentBox sandbox CLI with no registry install hooks. Scanner hits for credential phishing, unofficial gateways, malware fingerprints, and Trojan Source are explained by the documented configure command, first-party agentbox-runtime.ru API host, E2B-derived source, and bundled highlighter or parser data.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Nothing runs on npm install. Behavior starts only if a user executes the agentbox binary.

Impact

No confirmed malicious impact

Mechanism

No confirmed attack chain

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The agentbox CLI can prompt for an AgentBox API key and write it to ~/.agentbox/config.json.
Runtime API calls default to https://api.agentbox-runtime.ru using that key.
The minified bundle includes commander child_process spawn, an inquirer password prompt, and syntax-highlighter keyword lists that trip noisy scanner labels.

Evidence against

package.json has no preinstall, install, or postinstall scripts; published files are dist, LICENSE, README, NOTICE, and package.json.
configure is an explicit user command, requires keys starting with ab_, and writes only the product config with directory mode 448 and file mode 384.
Hosts and branding are first-party AgentBox (agentbox.ru, docs.agentbox.ru, agentbox-runtime.ru); NOTICE states this CLI is derived from the E2B SDK.
No webhook, Discord, Telegram, or other unrelated exfil sink; env reads are AGENTBOX_* product settings plus bundled library usage.
ibm.com, eval comments, password keyword lists, and unicode/ANSI sequences come from bundled HTML/highlighter/inquirer code, not a hidden payload.

Behavioral surface

Source & flagged code

12 flagged

dist/index.jsView file

1#!/usr/bin/env -S node --enable-source-maps L2: Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-CPUxUITh.js");let t=require("os");t=e.a(t);let n=require("path");n=e.a(n);let... L3: `),n=Math.max.apply(Math,t.map(function(e){return e.length})),r=[`┌${`─`.repeat(n+2)}┐`],i=0,a=t;i<a.length;i++){var o=a[i];r.push(`│ ${o.padEnd(n)} │`)}return r.push(`└${`─`.repea... L4: `)};t.exports=function(e){return c(void 0,void 0,void 0,function(){var t,n;return l(this,function(r){switch(r.label){case 0:if(!e.alwaysRun&&(!process.stdout.isTTY||g&&!e.shouldNot... L5: Current Version: ${e.pkg.version} ... L11: `?``:(t>0?c:``)+e.trimEnd()).join(` L12: `)}}})),Pe=e.t((e=>{let{InvalidArgumentError:t}=je();var n=class{constructor(e,t){this.flags=e,this.

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/index.jsView on unpkg · L1

10contains invisible/control Unicode U+200B (zero width space) `),c=` `.repeat(n),l=`\\s<U+200B>`,u=RegExp(`\n|.{1,${a-1}}([${l}]|$)|[^${l}]+?([${l}]|$)`,`g`);return o+(s.match(u)||[]).map((e,t)=>e===`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L10

1Trigger-reachable chain: manifest.bin -> dist/index.js L1: #!/usr/bin/env -S node --enable-source-maps L2: Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-CPUxUITh.js");let t=require("os");t=e.a(t);let n=require("path");n=e.a(n);let... L3: `),n=Math.max.apply(Math,t.map(function(e){return e.length})),r=[`┌${`─`.repeat(n+2)}┐`],i=0,a=t;i<a.length;i++){var o=a[i];r.push(`│ ${o.padEnd(n)} │`)}return r.push(`└${`─`.repea... L4: `)};t.exports=function(e){return c(void 0,void 0,void 0,function(){var t,n;return l(this,function(r){switch(r.label){case 0:if(!e.alwaysRun&&(!process.stdout.isTTY||g&&!e.shouldNot... L5: Current Version: ${e.pkg.version} ... L11: `?``:(t>0?c:``)+e.trimEnd()).join(` L12: `)}}})),Pe=e.t((e=>{let{InvalidArgumentError:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

11`?``:(t>0?c:``)+e.trimEnd()).join(` L12: `)}}})),Pe=e.t((e=>{let{InvalidArgumentError:t}=je();var n=class{constructor(e,t){this.flags=e,this.description=t||``,this.required=e.includes(`<`),this.optional=e.includes(`[`),th... L13: - specify the name in Command constructor or using .name()`);return t||={},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(e...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L11

1#!/usr/bin/env -S node --enable-source-maps L2: Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-CPUxUITh.js");let t=require("os");t=e.a(t);let n=require("path");n=e.a(n);let... L3: `),n=Math.max.apply(Math,t.map(function(e){return e.length})),r=[`┌${`─`.repeat(n+2)}┐`],i=0,a=t;i<a.length;i++){var o=a[i];r.push(`│ ${o.padEnd(n)} │`)}return r.push(`└${`─`.repea... ... L11: `?``:(t>0?c:``)+e.trimEnd()).join(` L12: `)}}})),Pe=e.t((e=>{let{InvalidArgumentError:t}=je();var n=class{constructor(e,t){this.flags=e,this.description=t||``,this.required=e.includes(`<`),this.optional=e.includes(`[`),th... L13: - specify the name in Command constructor or using .name()`);return t||={},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.h

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-CPUxUITh.js");let t=require("os");t=e.a(t);let n=require("path");n=e.a(n);let... `))},"after:highlightElement":({result:e})=>{f.useBR&&(e.value=e.value.replace(/\n/g,`<br>`))}},C=/^(<[^>]+>|\t)+/gm,w={"after:highlightElement":({result:e})=>{f.tabReplace&&(e.val... ]`,{returnEnd:!0,relevance:0}),{className:`title`,begin:`[\\[\\]]`,relevance:0},{className:`string`,begin:`[\\.,]`,relevance:0},{begin:/(?:\+\+|--)/,contains:[t]},t]}}t.exports=n})... `},u]}}t.exports=o})),xr=e.t(((e,t)=>{function n(e){let t=`<\\?(lasso(script

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env -S node --enable-source-maps L2: Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-CPUxUITh.js");let t=require("os");t=e.a(t);let n=require("path");n=e.a(n);let... L3: `),n=Math.max.apply(Math,t.map(function(e){return e.length})),r=[`┌${`─`.repeat(n+2)}┐`],i=0,a=t;i<a.length;i++){var o=a[i];r.push(`│ ${o.padEnd(n)} │`)}return r.push(`└${`─`.repea... ... L11: `?``:(t>0?c:``)+e.trimEnd()).join(` L12: `)}}})),Pe=e.t((e=>{let{InvalidArgumentError:t}=je();var n=class{constructor(e,t){this.flags=e,this.description=t||``,this.required=e.includes(`<`),this.optional=e.includes(`[`),th... L13: - specify the name in Command constructor or using .name()`);return t||={},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.h

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/index.js L1: #!/usr/bin/env -S node --enable-source-maps L2: Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-CPUxUITh.js");let t=require("os");t=e.a(t);let n=require("path");n=e.a(n);let... L3: `),n=Math.max.apply(Math,t.map(function(e){return e.length})),r=[`┌${`─`.repeat(n+2)}┐`],i=0,a=t;i<a.length;i++){var o=a[i];r.push(`│ ${o.padEnd(n)} │`)}return r.push(`└${`─`.repea... L4: `)};t.exports=function(e){return c(void 0,void 0,void 0,function(){var t,n;return l(this,function(r){switch(r.label){case 0:if(!e.alwaysRun&&(!process.stdout.isTTY||g&&!e.shouldNot... L5: Current Version: ${e.pkg.version} ... L11: `?``:(t>0?c:``)+e.trimEnd()).join(` L12: `)}}})),Pe=e.t((e

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @abox-dev/cli@0.1.4 matchedPath = dist/index.js matchedIdentity = npm:QGFib3gtZGV2L2NsaQ:0.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8cbc1206d459aac9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @abox-dev/cli@0.1.4 matchedPath = dist/index.js matchedIdentity = npm:QGFib3gtZGV2L2NsaQ:0.1.4 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

Source & flagged code

12 flagged · loading source

dist/index.jsView file

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/index.jsView on unpkg · L1

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L10

Findings

3 Critical8 High4 Medium4 Low

CriticalBrowser Credential Phishingdist/index.js

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighRemote Agent Bridgedist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Fingerprint Signaturedist/index.js

Medium

Affected versions and remediation

This report applies to @abox-dev/cli@0.1.6.

See all versions of @abox-dev/cli for other recorded verdicts.

Review the evidence and your use of @abox-dev/cli@0.1.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 22:58:57.529Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.