@agentprojectcontext/apx@1.61.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@agentprojectcontext/apx@1.61.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/interfaces/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/interfaces/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/core/http-tools/browser.jsView file

401// eslint-disable-next-line no-new-func L402: result = await page.evaluate(new Function(code)); L403: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/http-tools/browser.jsView on unpkg · L401

src/interfaces/web/dist/assets/index-DRFIAiiq.jsView file

59L60: Please change the parent <Route path="${y}"> to <Route path="${y==="/"?"*":`${y}/*`}">.`)}let h=ts(),b;if(t){let y=typeof t=="string"?oi(t):t;rn(m==="/"||y.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-DRFIAiiq.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

7// L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L18: import path from "node:path"; L19: import { execFileSync } from "node:child_process"; L20: import { fileURLToPath } from "node:url"; ... L22: const __filename = fileURLToPath(import.meta.url); L23: const __dirname = path.dirname(__filename); L24: ... L81: try { L82: if (process.platform === "darwin") return fs.existsSync(MAC_PLIST_PATH); L83: if (process.platform === "linux") return fs.existsSync(LINUX_DESKTOP_PATH);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/core/desktop/autostart.jsView on unpkg · L7

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/asset/pulse-a.wavView file

•path = src/interfaces/tui/asset/pulse-a.wav kind = high_entropy_blob sizeBytes = 176444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/tui/asset/pulse-a.wavView on unpkg

src/host/daemon/api/skills.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agentprojectcontext/apx@1.58.0 matchedIdentity = npm:[redacted]:1.58.0 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/daemon/api/skills.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 22-62json

22 "skills/",

23 "README.md",

24 "!**/node_modules/**",

25 "!**/e2e/**",

26 "!**/playwright-report/**",

27 "!**/test-results/**",

28 "!**/*.tsbuildinfo"

29 ],

30 "engines": {

31 "node": ">=18"

32 },

33 "scripts": {

34 "start": "node src/host/daemon/index.js",

35 "smoke": "node src/host/daemon/smoke.js",

36 "test": "node --test --test-reporter=spec tests/*.test.js",

37 "build:web": "node scripts/build-web.js",

38 "preflight": "npm test && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit)",

39 "upgrade": "pnpm install && pnpm add -g .",

40 "prepare": "node scripts/install-githooks.js",

41 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

42 "postinstall": "node src/interfaces/cli/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "dependencies": {

45 "@modelcontextprotocol/sdk": "^1.29.0",

46 "@opentui/core": "^0.2.16",

47 "@opentui/keymap": "^0.2.16",

48 "@opentui/solid": "^0.2.16",

49 "@solid-primitives/event-bus": "^1.1.3",

50 "@solid-primitives/scheduled": "^1.5.2",

51 "chalk": "^5.6.2",

52 "cli-cursor": "^5.0.0",

53 "cli-sound": "^1.1.3",

54 "clipboardy": "^4.0.0",

55 "cron-parser": "^5.5.0",

56 "effect": "^3.21.2",

57 "esbuild-plugin-solid": "^0.6.0",

58 "express": "^4.21.0",

59 "fuzzysort": "^3.1.0",

60 "iconv-lite": "^0.6.3",

61 "node-fetch": "^3.3.2",

62 "open": "^10.1.2",

src/core/http-tools/browser.jsView file

Lines 381-421javascript

381 if (!code) throw new Error("code required");

382 return onPage((page) => evaluateOnPage(page, code));

383}

src/interfaces/web/dist/assets/index-DRFIAiiq.jsView file

59L60: Please change the parent <Route path="${y}"> to <Route path="${y==="/"?"*":`${y}/*`}">.`)}let h=ts(),b;if(t){let y=typeof t=="string"?oi(t):t;rn(m==="/"||y.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-DRFIAiiq.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/asset/pulse-a.wavView file

•path = src/interfaces/tui/asset/pulse-a.wav kind = high_entropy_blob sizeBytes = 176444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/tui/asset/pulse-a.wavView on unpkg

src/host/daemon/api/skills.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agentprojectcontext/apx@1.58.0 matchedIdentity = npm:[redacted]:1.58.0 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/daemon/api/skills.jsView on unpkg