registry / @agentprojectcontext/apx / 1.65.0

@agentprojectcontext/apx@1.65.0

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 715 file(s), 4.73 MB of source, external domains: 127.0.0.1, 192.168.1.50, agentprojectcontext.com, agentprojectcontext.github.io, api.anthropic.com, api.elevenlabs.io, api.example.com, api.github.com, api.groq.com, api.openai.com, api.search.brave.com, api.telegram.org, app.asana.com, base-ui.com, bun.sh, example.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, opencode.ai, opencode.internal, openrouter.ai, raw.githubusercontent.com, react.dev, registry.npmjs.org, t.me, wttr.in, www.apple.com, www.google.com, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 22-62json

22 "skills/",

23 "README.md",

24 "!**/node_modules/**",

25 "!**/e2e/**",

26 "!**/playwright-report/**",

27 "!**/test-results/**",

28 "!**/*.tsbuildinfo"

29 ],

30 "engines": {

31 "node": ">=18"

32 },

33 "scripts": {

34 "start": "node src/host/daemon/index.js",

35 "smoke": "node src/host/daemon/smoke.js",

36 "test": "node --test --test-reporter=spec tests/*.test.js",

37 "build:web": "node scripts/build-web.js",

38 "preflight": "npm test && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit)",

39 "upgrade": "pnpm install && pnpm add -g .",

40 "prepare": "node scripts/install-githooks.js",

41 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

42 "postinstall": "node src/interfaces/cli/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "dependencies": {

45 "@modelcontextprotocol/sdk": "^1.29.0",

46 "@opentui/core": "^0.2.16",

47 "@opentui/keymap": "^0.2.16",

48 "@opentui/solid": "^0.2.16",

49 "@solid-primitives/event-bus": "^1.1.3",

50 "@solid-primitives/scheduled": "^1.5.2",

51 "chalk": "^5.6.2",

52 "cli-cursor": "^5.0.0",

53 "cli-sound": "^1.1.3",

54 "clipboardy": "^4.0.0",

55 "cron-parser": "^5.5.0",

56 "effect": "^3.21.2",

57 "esbuild-plugin-solid": "^0.6.0",

58 "express": "^4.21.0",

59 "fuzzysort": "^3.1.0",

60 "iconv-lite": "^0.6.3",

61 "node-fetch": "^3.3.2",

62 "open": "^10.1.2",

src/core/http-tools/browser.jsView file

Lines 381-421javascript

381 if (!code) throw new Error("code required");

382 return onPage((page) => evaluateOnPage(page, code));

383}

src/interfaces/web/dist/assets/index-CFcs16SV.jsView file

59L60: Please change the parent <Route path="${y}"> to <Route path="${y==="/"?"*":`${y}/*`}">.`)}let h=ts(),b;if(t){let y=typeof t=="string"?oi(t):t;rn(m==="/"||y.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-CFcs16SV.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/asset/pulse-a.wavView file

•path = src/interfaces/tui/asset/pulse-a.wav kind = high_entropy_blob sizeBytes = 176444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/tui/asset/pulse-a.wavView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code