Loading npm security reports…

@agentprojectcontext/apx@1.105.0: Malicious npm security report | LPM Firewall

registry / @agentprojectcontext/apx / 1.105.0

@agentprojectcontext/apx@1.105.0

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installation runs a remote skill refresh and writes package-controlled skill content into several global AI-agent control surfaces. The remote content is taken from an unpinned main branch before propagation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes postinstall.

Impact

A future remote change can place instructions into Claude, Cursor, Codex, and other agent skill directories without an explicit setup command.

Mechanism

Remote skill download followed by broad global AI-agent skill installation.

Attack narrative

When npm runs postinstall, the package fetches an apc-context skill from a mutable GitHub main branch, writes it into the package, then copies bundled skills into global Claude, Cursor, Codex, and .agents directories. The hook does not require a separate user setup command or verify a pinned content hash. This creates an automatic remote-controlled path to alter broad AI-agent instruction surfaces.

AI rationale

This is an unconsented postinstall mutation of broad foreign AI-agent control surfaces, amplified by a remote mutable payload source. It meets the install-hook abuse blocking policy.

Evidence

package.jsonsrc/interfaces/cli/postinstall.jssrc/core/apc/skill-sync.jssrc/core/apc/scaffold.jsskills/apc-context/SKILL.mdsrc/core/runtime-skills/apc-context/SKILL.md~/.claude/skills/<slug>/SKILL.md~/.cursor/skills/<slug>/SKILL.md

Source & flagged code

28 flagged

package.jsonView file

Lines 28-68json

28 "!**/test-results/**",

29 "!**/*.tsbuildinfo"

30 ],

31 "engines": {

32 "node": ">=22"

33 },

34 "scripts": {

35 "start": "node src/host/daemon/index.js",

36 "smoke": "node src/host/daemon/smoke.js",

37 "test": "node scripts/test.js",

38 "test:ci": "node scripts/test-ci.js",

39 "lint": "eslint .",

40 "lint:fix": "eslint . --fix",

41 "lint:web": "node scripts/lint-web.js",

42 "typecheck:tui": "node scripts/typecheck-tui.js",

43 "build:web": "node scripts/build-web.js",

44 "preflight": "npm run lint && npm run lint:web && npm run test:ci && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit) && npm run typecheck:tui",

45 "upgrade": "pnpm install && pnpm add -g .",

46 "prepare": "node scripts/install-githooks.js && node scripts/sync-apc-skill.js",

47 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

48 "postinstall": "node src/interfaces/cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 "smoke:seam": "node --test --test-reporter=spec tests/smoke/*.smoke.js"

50 },

51 "dependencies": {

52 "@modelcontextprotocol/sdk": "^1.29.0",

53 "@opentui/core": "^0.2.16",

54 "@opentui/keymap": "^0.2.16",

55 "@opentui/solid": "^0.2.16",

56 "@solid-primitives/event-bus": "^1.1.3",

57 "@solid-primitives/scheduled": "^1.5.2",

58 "cli-sound": "^1.1.3",

59 "clipboardy": "^4.0.0",

60 "cron-parser": "^5.5.0",

61 "effect": "^3.21.2",

62 "express": "^4.21.0",

63 "fuzzysort": "^3.1.0",

64 "node-fetch": "^3.3.2",

65 "open": "^10.1.2",

66 "opentui-spinner": "^0.0.6",

67 "qrcode-terminal": "^0.12.0",

68 "remeda": "^2.21.0",

src/core/artifacts/tunnel.jsView file

Lines 1-32javascript

1// Quick public tunnels for local preview ports.

2//

3// Wraps zero-config tunnel providers so an ephemeral artifact preview running

4// on http://localhost:<port> can be shared with a temporary public URL:

5// - cloudflared → `cloudflared tunnel --url http://localhost:PORT`

6// (no account needed; prints an https://*.trycloudflare.com URL)

7// - localtunnel → `npx -y localtunnel --port PORT`

8// (prints https://*.loca.lt; fallback when cloudflared absent)

9//

10// The manager spawns the provider, scrapes the public URL from its output, and

src/core/net/tailscale.jsView file

Lines 25-65javascript

25const CANDIDATES = [

26 "/Applications/Tailscale.app/Contents/MacOS/Tailscale",

27 "/usr/local/bin/tailscale",

28 "/opt/homebrew/bin/tailscale",

29 "/usr/bin/tailscale",

30 "/usr/sbin/tailscale"

src/core/http-tools/browser.jsView file

Lines 710-750javascript

710 if (!code) throw new Error("code required");

711 return onPage((page) => evaluateOnPage(page, code));

712}

src/core/voice/transcription.js#virtual:normalized:round1View file

52* else faster-whisper cpu. L53: * Safety net: if the chosen mlx model isn"t downloaded yet, fall back to\n * faster-whisper so a live voice turn never stalls on a multi-GB download —\n * the model-manager UI hand... L54: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/core/voice/transcription.js#virtual:normalized:round1View on unpkg · L52

src/core/channels/whatsapp/stickers.jsView file

Lines 16-56javascript

16// across senders and chats (the same sticker pack sends identical bytes), which

17// is exactly the property a lexicon needs and exactly what a per-message id

18// lacks.

19//

20// The owner can overwrite any entry with their own words (`meaning_source:

21// "owner"`), and a human meaning is never overwritten by a later automatic

22// description — the point of learning is that it accumulates.

23import fs from "node:fs";

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /api/desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

src/interfaces/cli/http.jsView file

7import fs from "node:fs"; L8: import nodeHttp from "node:http"; L9: import os from "node:os"; ... L11: import { TOKEN_PATH, LOG_PATH } from "#core/config/paths.js"; L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url"; ... L17: L18: const DEFAULT_PORT = parseInt(process.env.APX_PORT || "7430", 10); L19: const DEFAULT_HOST = process.env.APX_HOST || "127.0.0.1";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/interfaces/cli/http.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/interfaces/cli/http.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/http.jsView on unpkg

src/host/daemon/pty-bridge.pyView file

•path = src/host/daemon/pty-bridge.py kind = build_helper sizeBytes = 3335 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/pty-bridge.pyView on unpkg

src/interfaces/web/dist/sw.js.gzView file

•path = src/interfaces/web/dist/sw.js.gz kind = compressed_blob sizeBytes = 1818 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

src/interfaces/web/dist/sw.js.gzView on unpkg

src/interfaces/web/dist/modules/blobs/onyx.svg.brView file

•path = [redacted].svg.br kind = high_entropy_blob sizeBytes = 37288 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/web/dist/modules/blobs/onyx.svg.brView on unpkg

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 47505 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

src/core/http-tools/browser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/core/http-tools/browser.js#virtual:normalized:round1View on unpkg

src/interfaces/cli/commands/image.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/image.jsView on unpkg

src/host/daemon/api/admin.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/host/daemon/api/admin.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg

src/interfaces/cli/commands/desktop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/desktop.jsView on unpkg

src/interfaces/cli/commands/voice.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/voice.jsView on unpkg

src/core/desktop/process.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/core/desktop/process.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/process.jsView on unpkg

src/core/voice/engines/gemini.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/core/voice/engines/gemini.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/voice/engines/gemini.jsView on unpkg

src/host/daemon/api/skills.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/host/daemon/api/skills.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/skills.jsView on unpkg

src/host/daemon/terminal-ws.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/host/daemon/terminal-ws.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/terminal-ws.jsView on unpkg

src/host/daemon/whisper-server.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/host/daemon/whisper-server.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/whisper-server.jsView on unpkg

src/interfaces/cli/commands/artifact.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/artifact.jsView on unpkg

Source & flagged code

28 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/interfaces/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/interfaces/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/core/artifacts/tunnel.jsView file

12// on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

src/core/artifacts/tunnel.jsView on unpkg · L12

6// (no account needed; prints an https://*.trycloudflare.com URL) L7: // - localtunnel → `npx -y localtunnel --port PORT` L8: // (prints https://*.loca.lt; fallback when cloudflared absent) ... L12: // on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/artifacts/tunnel.jsView on unpkg · L6

src/core/net/tailscale.jsView file

45try { L46: const found = execFileSync("command", ["-v", "tailscale"], { shell: true, encoding: "utf8" }).trim(); L47: if (found) return (cachedBinary = found);

High

Shell

Package source references shell execution.

src/core/net/tailscale.jsView on unpkg · L45

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.103.0 matchedPath = src/core/net/tailscale.js matchedIdentity = npm:[redacted]:1.103.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/net/tailscale.jsView on unpkg

src/core/http-tools/browser.jsView file

730// eslint-disable-next-line no-new-func L731: result = await page.evaluate(new Function(code)); L732: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/http-tools/browser.jsView on unpkg · L730

src/core/voice/transcription.js#virtual:normalized:round1View file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/core/voice/transcription.js#virtual:normalized:round1View on unpkg · L52

src/core/channels/whatsapp/stickers.jsView file

36* L37: * The key is base64 of WhatsApp's content hash, so it carries "/" and "+" — a L38: * path built from it straight would escape the directory on the first slash. ... L309: // sticker came back unnamed and nothing said why. L310: images: [{ data: fs.readFileSync(localPath).toString("base64"), mime }], L311: }],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/channels/whatsapp/stickers.jsView on unpkg · L36

src/core/desktop/autostart.jsView file

7Trigger-reachable persistence chain: scripts.start -> src/host/daemon/index.js -> src/host/daemon/api.js -> src/host/daemon/api/desktop.js -> src/core/desktop/autostart.js L7: // L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L19: import { DESKTOP_AUTOSTART_LOG_PATH } from "#core/config/paths.js"; L20: import { execFileSync } from "node:child_process"; L21: import { fileURLToPath } from "node:url"; ... L24: const __filename = fileURLToPath(import.meta.url); L25: const __dirname = path.dirname(__filename); L26: ... L90: L91: // The three functions below take `platform` instead of reading process.platform L92: // inline so the unsupported-platform branch is reachable fro

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/core/desktop/autostart.jsView on unpkg · L7

7// L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L19: import { DESKTOP_AUTOSTART_LOG_PATH } from "#core/config/paths.js"; L20: import { execFileSync } from "node:child_process"; L21: import { fileURLToPath } from "node:url"; ... L24: const __filename = fileURLToPath(import.meta.url); L25: const __dirname = path.dirname(__filename); L26: ... L90: L91: // The three functions below take `platform` instead of reading process.platform L92: // inline so the unsupported-platform branch is reachable from a test on any

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/core/desktop/autostart.jsView on unpkg · L7

src/interfaces/cli/http.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/interfaces/cli/http.jsView on unpkg · L7

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/http.jsView on unpkg

src/host/daemon/pty-bridge.pyView file

•path = src/host/daemon/pty-bridge.py kind = build_helper sizeBytes = 3335 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/pty-bridge.pyView on unpkg

src/interfaces/web/dist/sw.js.gzView file

•path = src/interfaces/web/dist/sw.js.gz kind = compressed_blob sizeBytes = 1818 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

src/interfaces/web/dist/sw.js.gzView on unpkg

src/interfaces/web/dist/modules/blobs/onyx.svg.brView file

•path = [redacted].svg.br kind = high_entropy_blob sizeBytes = 37288 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/web/dist/modules/blobs/onyx.svg.brView on unpkg

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 47505 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

src/core/http-tools/browser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/core/http-tools/browser.js#virtual:normalized:round1View on unpkg

src/interfaces/cli/commands/image.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/image.jsView on unpkg

src/host/daemon/api/admin.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg

src/interfaces/cli/commands/desktop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/desktop.jsView on unpkg

src/interfaces/cli/commands/voice.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/voice.jsView on unpkg

src/core/desktop/process.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/process.jsView on unpkg

src/core/voice/engines/gemini.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/voice/engines/gemini.jsView on unpkg

src/host/daemon/api/skills.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/skills.jsView on unpkg

src/host/daemon/terminal-ws.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/terminal-ws.jsView on unpkg

src/host/daemon/whisper-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/whisper-server.jsView on unpkg

src/interfaces/cli/commands/artifact.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/artifact.jsView on unpkg

Source & flagged code

28 flagged

package.jsonView file

Lines 28-68json

28 "!**/test-results/**",

29 "!**/*.tsbuildinfo"

30 ],

31 "engines": {

32 "node": ">=22"

33 },

34 "scripts": {

35 "start": "node src/host/daemon/index.js",

36 "smoke": "node src/host/daemon/smoke.js",

37 "test": "node scripts/test.js",

38 "test:ci": "node scripts/test-ci.js",

39 "lint": "eslint .",

40 "lint:fix": "eslint . --fix",

41 "lint:web": "node scripts/lint-web.js",

42 "typecheck:tui": "node scripts/typecheck-tui.js",

43 "build:web": "node scripts/build-web.js",

44 "preflight": "npm run lint && npm run lint:web && npm run test:ci && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit) && npm run typecheck:tui",

45 "upgrade": "pnpm install && pnpm add -g .",

46 "prepare": "node scripts/install-githooks.js && node scripts/sync-apc-skill.js",

47 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

48 "postinstall": "node src/interfaces/cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 "smoke:seam": "node --test --test-reporter=spec tests/smoke/*.smoke.js"

50 },

51 "dependencies": {

52 "@modelcontextprotocol/sdk": "^1.29.0",

53 "@opentui/core": "^0.2.16",

54 "@opentui/keymap": "^0.2.16",

55 "@opentui/solid": "^0.2.16",

56 "@solid-primitives/event-bus": "^1.1.3",

57 "@solid-primitives/scheduled": "^1.5.2",

58 "cli-sound": "^1.1.3",

59 "clipboardy": "^4.0.0",

60 "cron-parser": "^5.5.0",

61 "effect": "^3.21.2",

62 "express": "^4.21.0",

63 "fuzzysort": "^3.1.0",

64 "node-fetch": "^3.3.2",

65 "open": "^10.1.2",

66 "opentui-spinner": "^0.0.6",

67 "qrcode-terminal": "^0.12.0",

68 "remeda": "^2.21.0",

src/core/artifacts/tunnel.jsView file

Lines 1-32javascript

1// Quick public tunnels for local preview ports.

2//

3// Wraps zero-config tunnel providers so an ephemeral artifact preview running

4// on http://localhost:<port> can be shared with a temporary public URL:

5// - cloudflared → `cloudflared tunnel --url http://localhost:PORT`

6// (no account needed; prints an https://*.trycloudflare.com URL)

7// - localtunnel → `npx -y localtunnel --port PORT`

8// (prints https://*.loca.lt; fallback when cloudflared absent)

9//

10// The manager spawns the provider, scrapes the public URL from its output, and

src/core/net/tailscale.jsView file

Lines 25-65javascript

25const CANDIDATES = [

26 "/Applications/Tailscale.app/Contents/MacOS/Tailscale",

27 "/usr/local/bin/tailscale",

28 "/opt/homebrew/bin/tailscale",

29 "/usr/bin/tailscale",

30 "/usr/sbin/tailscale"

src/core/http-tools/browser.jsView file

Lines 710-750javascript

710 if (!code) throw new Error("code required");

711 return onPage((page) => evaluateOnPage(page, code));

712}

src/core/voice/transcription.js#virtual:normalized:round1View file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/core/voice/transcription.js#virtual:normalized:round1View on unpkg · L52

src/core/channels/whatsapp/stickers.jsView file

Lines 16-56javascript

16// across senders and chats (the same sticker pack sends identical bytes), which

17// is exactly the property a lexicon needs and exactly what a per-message id

18// lacks.

19//

20// The owner can overwrite any entry with their own words (`meaning_source:

21// "owner"`), and a human meaning is never overwritten by a later automatic

22// description — the point of learning is that it accumulates.

23import fs from "node:fs";

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /api/desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

src/interfaces/cli/http.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/interfaces/cli/http.jsView on unpkg · L7

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/http.jsView on unpkg

src/host/daemon/pty-bridge.pyView file

•path = src/host/daemon/pty-bridge.py kind = build_helper sizeBytes = 3335 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/pty-bridge.pyView on unpkg

src/interfaces/web/dist/sw.js.gzView file

•path = src/interfaces/web/dist/sw.js.gz kind = compressed_blob sizeBytes = 1818 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

src/interfaces/web/dist/sw.js.gzView on unpkg

src/interfaces/web/dist/modules/blobs/onyx.svg.brView file

•path = [redacted].svg.br kind = high_entropy_blob sizeBytes = 37288 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/web/dist/modules/blobs/onyx.svg.brView on unpkg

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 47505 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

src/core/http-tools/browser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/core/http-tools/browser.js#virtual:normalized:round1View on unpkg

src/interfaces/cli/commands/image.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/image.jsView on unpkg

src/host/daemon/api/admin.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg

src/interfaces/cli/commands/desktop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/desktop.jsView on unpkg

src/interfaces/cli/commands/voice.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/voice.jsView on unpkg

src/core/desktop/process.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/process.jsView on unpkg

src/core/voice/engines/gemini.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/voice/engines/gemini.jsView on unpkg

src/host/daemon/api/skills.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/skills.jsView on unpkg

src/host/daemon/terminal-ws.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/terminal-ws.jsView on unpkg

src/host/daemon/whisper-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/whisper-server.jsView on unpkg

src/interfaces/cli/commands/artifact.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/cli/commands/artifact.jsView on unpkg

@agentprojectcontext/apx@1.105.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code