registry / @agentprojectcontext/apx / 1.53.7

@agentprojectcontext/apx@1.53.7

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 665 file(s), 4.40 MB of source, external domains: 127.0.0.1, 192.168.1.50, agentprojectcontext.com, agentprojectcontext.github.io, api.anthropic.com, api.elevenlabs.io, api.example.com, api.github.com, api.groq.com, api.openai.com, api.search.brave.com, api.telegram.org, base-ui.com, example.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, opencode.ai, opencode.internal, openrouter.ai, raw.githubusercontent.com, react.dev, registry.npmjs.org, t.me, wttr.in, www.apple.com, www.google.com, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 22-62json

22 "skills/",

23 "README.md",

24 "!**/node_modules/**",

25 "!**/e2e/**",

26 "!**/playwright-report/**",

27 "!**/test-results/**",

28 "!**/*.tsbuildinfo"

29 ],

30 "engines": {

31 "node": ">=18"

32 },

33 "scripts": {

34 "start": "node src/host/daemon/index.js",

35 "smoke": "node src/host/daemon/smoke.js",

36 "test": "node --test --test-reporter=spec tests/*.test.js",

37 "build:web": "node scripts/build-web.js",

38 "preflight": "npm test && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit)",

39 "upgrade": "pnpm install && pnpm add -g .",

40 "prepare": "node scripts/install-githooks.js",

41 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

42 "postinstall": "node src/interfaces/cli/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "dependencies": {

45 "@modelcontextprotocol/sdk": "^1.29.0",

46 "@opentui/core": "^0.2.16",

47 "@opentui/keymap": "^0.2.16",

48 "@opentui/solid": "^0.2.16",

49 "@solid-primitives/event-bus": "^1.1.3",

50 "@solid-primitives/scheduled": "^1.5.2",

51 "chalk": "^5.6.2",

52 "cli-cursor": "^5.0.0",

53 "cli-sound": "^1.1.3",

54 "clipboardy": "^4.0.0",

55 "cron-parser": "^5.5.0",

56 "effect": "^3.21.2",

57 "esbuild-plugin-solid": "^0.6.0",

58 "express": "^4.21.0",

59 "fuzzysort": "^3.1.0",

60 "iconv-lite": "^0.6.3",

61 "node-fetch": "^3.3.2",

62 "open": "^10.1.2",

src/core/http-tools/browser.jsView file

Lines 381-421javascript

381 if (!code) throw new Error("code required");

382 return onPage((page) => evaluateOnPage(page, code));

383}

384

385async function evaluateOnPage(

src/interfaces/web/dist/assets/index-Bks35ks-.jsView file

59L60: Please change the parent <Route path="${y}"> to <Route path="${y==="/"?"*":`${y}/*`}">.`)}let h=Qn(),b;if(t){let y=typeof t=="string"?Kl(t):t;en(m==="/"||y.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-Bks35ks-.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

11//

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/asset/pulse-a.wavView file

•path = src/interfaces/tui/asset/pulse-a.wav kind = high_entropy_blob sizeBytes = 176444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/tui/asset/pulse-a.wavView on unpkg

src/host/daemon/api/admin.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agentprojectcontext/apx@1.53.6 matchedIdentity = npm:[redacted]:1.53.6 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/interfaces/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/interfaces/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/core/http-tools/browser.jsView file

401// eslint-disable-next-line no-new-func L402: result = await page.evaluate(new Function(code)); L403: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/http-tools/browser.jsView on unpkg · L401

src/interfaces/web/dist/assets/index-Bks35ks-.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-Bks35ks-.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

7// L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L18: import path from "node:path"; L19: import { execFileSync } from "node:child_process"; L20: import { fileURLToPath } from "node:url"; ... L22: const __filename = fileURLToPath(import.meta.url); L23: const __dirname = path.dirname(__filename); L24: ... L81: try { L82: if (process.platform === "darwin") return fs.existsSync(MAC_PLIST_PATH); L83: if (process.platform === "linux") return fs.existsSync(LINUX_DESKTOP_PATH);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/core/desktop/autostart.jsView on unpkg · L7

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/asset/pulse-a.wavView file

•path = src/interfaces/tui/asset/pulse-a.wav kind = high_entropy_blob sizeBytes = 176444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/tui/asset/pulse-a.wavView on unpkg

src/host/daemon/api/admin.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg

Findings

3 High7 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobsrc/interfaces/tui/asset/pulse-a.wav

HighPrevious Version Dangerous Deltasrc/host/daemon/api/admin.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/interfaces/web/dist/assets/index-Bks35ks-.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/core/desktop/autostart.js

MediumShips Build Helpersrc/host/daemon/whisper-server.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/core/http-tools/browser.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 22-62json

22 "skills/",

23 "README.md",

24 "!**/node_modules/**",

25 "!**/e2e/**",

26 "!**/playwright-report/**",

27 "!**/test-results/**",

28 "!**/*.tsbuildinfo"

29 ],

30 "engines": {

31 "node": ">=18"

32 },

33 "scripts": {

34 "start": "node src/host/daemon/index.js",

35 "smoke": "node src/host/daemon/smoke.js",

36 "test": "node --test --test-reporter=spec tests/*.test.js",

37 "build:web": "node scripts/build-web.js",

38 "preflight": "npm test && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit)",

39 "upgrade": "pnpm install && pnpm add -g .",

40 "prepare": "node scripts/install-githooks.js",

41 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

42 "postinstall": "node src/interfaces/cli/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "dependencies": {

45 "@modelcontextprotocol/sdk": "^1.29.0",

46 "@opentui/core": "^0.2.16",

47 "@opentui/keymap": "^0.2.16",

48 "@opentui/solid": "^0.2.16",

49 "@solid-primitives/event-bus": "^1.1.3",

50 "@solid-primitives/scheduled": "^1.5.2",

51 "chalk": "^5.6.2",

52 "cli-cursor": "^5.0.0",

53 "cli-sound": "^1.1.3",

54 "clipboardy": "^4.0.0",

55 "cron-parser": "^5.5.0",

56 "effect": "^3.21.2",

57 "esbuild-plugin-solid": "^0.6.0",

58 "express": "^4.21.0",

59 "fuzzysort": "^3.1.0",

60 "iconv-lite": "^0.6.3",

61 "node-fetch": "^3.3.2",

62 "open": "^10.1.2",

src/core/http-tools/browser.jsView file

Lines 381-421javascript

381 if (!code) throw new Error("code required");

382 return onPage((page) => evaluateOnPage(page, code));

383}

384

385async function evaluateOnPage(

src/interfaces/web/dist/assets/index-Bks35ks-.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-Bks35ks-.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

11//

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/asset/pulse-a.wavView file

•path = src/interfaces/tui/asset/pulse-a.wav kind = high_entropy_blob sizeBytes = 176444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/tui/asset/pulse-a.wavView on unpkg

src/host/daemon/api/admin.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg