@agent-qofeno/agentx-cli@3.0.3
To install dependencies:
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe automatic hook delivers an unverified executable, creating a real but unconfirmed payload risk. No inspected source establishes malicious behavior, so this warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation on a supported platform when the target executable is absent.
Impact
The release host can supply code that becomes available as the package CLI; source inspection does not establish malicious payload behavior.
Mechanism
The hook fetches a release archive, extracts it with tar, and copies the executable into the package’s bin directory.
AI rationale
The automatic hook delivers an unverified executable, creating a real but unconfirmed payload risk. No inspected source establishes malicious behavior, so this warrants a warning rather than a publish block.
Evidence
package.jsonbin/postinstall.mjsbin/agentx
Network endpoints1
github.com/SohailKhan0525/agentxcode/releases/download/
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs bin/postinstall.mjs automatically after installation.
- The hook downloads a platform-specific archive from the project’s GitHub release URL without source-level integrity verification.
- It extracts the archive and copies its executable into the package bin directory.
- The flagged LSP code parses local Java version output and fetches a language server distribution; it does not send command output to an external endpoint.
Evidence against
- The downloaded executable is associated with the package’s own project release and is installed in the package’s bin directory.
- The LSP source’s network requests and local command use are consistent with language server setup.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg22scripts.postinstall = node ./bin/postinstall.mjs
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L22: const exeExt = isWin ? ".exe" : ""
L23: const targetBinary = path.join(scriptDir, "agentx" + exeExt)
L24:
L25: if (fs.existsSync(targetBinary)) {
L26: process.exit(0)
...
L48: const releaseTag = "v3.0.1"
L49: const archiveExt = isWin ? ".zip" : ".tar.gz"
L50: const archiveName = `agentx-${platform}-${arch}${archiveExt}`
L51: const downloadUrl = `https://github.[redacted]/${releaseTag}/${archiveName}`
L52:
...
L57: try {
L58: const res = await fetch(downloadUrl, { redirect: "follow" })
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L22•scripts.postinstall = node ./bin/postinstall.mjs
Medium
Findings
1 Critical5 High5 Medium5 Low
CriticalCommand Output Exfiltrationsrc/lsp/server.ts
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/postinstall.mjs
HighShell
HighUnverified Remote Native Payload Installpackage.json
HighSandbox Evasion Gated Capabilitysrc/lsp/server.ts
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiresrc/config/config.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
Low
Affected versions and remediation
This report applies to @agent-qofeno/agentx-cli@3.0.3.
See all versions of @agent-qofeno/agentx-cli for other recorded verdicts.
- Review the evidence and your use of @agent-qofeno/agentx-cli@3.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.