registry / @agent-qofeno/agentx-cli / 3.0.0

@agent-qofeno/agentx-cli@3.0.0

To install dependencies:

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The postinstall behavior is a conventional platform-binary bootstrap with exact same-vendor dependencies and ignored nested lifecycle scripts. Source inspection found no concrete malicious action or broad AI-agent control-surface mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall or a user invoking the agentx command.

Impact

No confirmed credential, data, configuration, or destructive impact.

Mechanism

Platform-specific binary installation and CLI process forwarding.

AI rationale

Evidence

package.jsonbin/agentx

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Postinstall installs a pinned platform package into a temporary directory, copies its binary, and runs it with --version.

Evidence against

All selected platform packages use the same scoped vendor name and exact 3.0.0 version.
Reviewed code contains no credential harvesting, exfiltration, agent-configuration writes, or destructive project changes.
The command wrapper forwards user arguments to the resolved platform binary.

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 5.41 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-49json

2 "name": "@agent-qofeno/agentx-cli",

3 "bin": {

4 "agentx": "./bin/agentx",

5 "opencode": "./bin/agentx"

6 },

7 "scripts": {

8 "postinstall": "node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

Low

Suspicious Lifecycle Evidence

Postinstall installs a pinned platform package into a temporary directory, copies its binary, and runs it with --version.

package.jsonView on unpkg · L7

10 "version": "3.0.0",

11 "license": "MIT",

12 "keywords": [

13 "ai",

14 "cli",

15 "agent",

16 "coding",

17 "typescript",

18 "terminal",

19 "bun",

20 "agentx"

21 ],

22 "os": [

23 "darwin",

24 "linux",

25 "win32"

26 ],

27 "cpu": [

28 "arm64",

29 "x64"

30 ],

31 "optionalDependencies": {

32 "@agent-qofeno/agentx-cli-linux-x64-baseline": "3.0.0",

33 "@agent-qofeno/agentx-cli-linux-arm64-musl": "3.0.0",

34 "@agent-qofeno/agentx-cli-windows-x64-baseline": "3.0.0",

35 "@agent-qofeno/agentx-cli-windows-arm64": "3.0.0",

36 "@agent-qofeno/agentx-cli-linux-x64-baseline-musl": "3.0.0",

37 "@agent-qofeno/agentx-cli-darwin-arm64": "3.0.0",

38 "@agent-qofeno/agentx-cli-darwin-x64": "3.0.0",

39 "@agent-qofeno/agentx-cli-darwin-x64-baseline": "3.0.0",

40 "@agent-qofeno/agentx-cli-linux-arm64": "3.0.0",

41 "@agent-qofeno/agentx-cli-linux-x64-musl": "3.0.0",

Low

Suspicious Lifecycle Evidence

Postinstall installs a pinned platform package into a temporary directory, copies its binary, and runs it with --version.

package.jsonView on unpkg · L31

42 "@agent-qofeno/agentx-cli-windows-x64": "3.0.0",

43 "@agent-qofeno/agentx-cli-linux-x64": "3.0.0"

44 },

45 "repository": {

46 "type": "git",

47 "url": "https://github.com/SohailKhan0525/agentxcode"

48 }

49}

postinstall.mjsView file

Lines 112-178javascript

112 return [base, `${base}-musl`]

113 }

114

115 if (arch === "x64") return baseline ? [`${base}-baseline`, base] :

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

7"scripts": { "postinstall": "node ./postinstall.mjs" },

Low

Suspicious Lifecycle Evidence

Postinstall installs a pinned platform package into a temporary directory, copies its binary, and runs it with --version.

package.jsonView on unpkg · L7

31"optionalDependencies": { "@agent-qofeno/agentx-cli-linux-x64-baseline": "3.0.0", "@agent-qofeno/agentx-cli-linux-arm64-musl": "3.0.0", "@agent-qofeno/agentx-cli-windows-x64-baseline": "3.0.0", "@agent-qofeno/agentx-cli-windows-arm64": "3.0.0", "@agent-qofeno/agentx-cli-linux-x64-baseline-musl": "3.0.0", "@agent-qofeno/agentx-cli-darwin-arm64": "3.0.0", "@agent-qofeno/agentx-cli-darwin-x64": "3.0.0", "@agent-qofeno/agentx-cli-darwin-x64-baseline": "3.0.0", "@agent-qofeno/agentx-cli-linux-arm64": "3.0.0", "@agent-qofeno/agentx-cli-linux-x64-musl": "3.0.

Findings

1 High2 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidencepostinstall.mjs

Affected versions and remediation

This report applies to @agent-qofeno/agentx-cli@3.0.0.

See all versions of @agent-qofeno/agentx-cli for other recorded verdicts.

Review the evidence and your use of @agent-qofeno/agentx-cli@3.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 15:47:40.960Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.