registry / @agentprojectcontext/apx / 1.70.0

@agentprojectcontext/apx@1.70.0

⚠ Under review

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 742 file(s), 4.97 MB of source, external domains: 127.0.0.1, 192.168.1.50, agentprojectcontext.com, agentprojectcontext.github.io, api.anthropic.com, api.elevenlabs.io, api.example.com, api.github.com, api.groq.com, api.openai.com, api.search.brave.com, api.telegram.org, app.asana.com, base-ui.com, bun.sh, cdn.tailwindcss.com, example.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, opencode.ai, opencode.internal, openrouter.ai, raw.githubusercontent.com, react.dev, registry.npmjs.org, t.me, unpkg.com, wttr.in, www.apple.com, www.google.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 23-63json

23 "skills/",

24 "README.md",

25 "!**/node_modules/**",

26 "!**/e2e/**",

27 "!**/playwright-report/**",

28 "!**/test-results/**",

29 "!**/*.tsbuildinfo"

30 ],

31 "engines": {

32 "node": ">=18"

33 },

34 "scripts": {

35 "start": "node src/host/daemon/index.js",

36 "smoke": "node src/host/daemon/smoke.js",

37 "test": "node --test --test-reporter=spec tests/*.test.js",

38 "build:web": "node scripts/build-web.js",

39 "preflight": "npm test && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit)",

40 "upgrade": "pnpm install && pnpm add -g .",

41 "prepare": "node scripts/install-githooks.js",

42 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

43 "postinstall": "node src/interfaces/cli/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 },

45 "dependencies": {

46 "@modelcontextprotocol/sdk": "^1.29.0",

47 "@opentui/core": "^0.2.16",

48 "@opentui/keymap": "^0.2.16",

49 "@opentui/solid": "^0.2.16",

50 "@solid-primitives/event-bus": "^1.1.3",

51 "@solid-primitives/scheduled": "^1.5.2",

52 "chalk": "^5.6.2",

53 "cli-cursor": "^5.0.0",

54 "cli-sound": "^1.1.3",

55 "clipboardy": "^4.0.0",

56 "cron-parser": "^5.5.0",

57 "effect": "^3.21.2",

58 "esbuild-plugin-solid": "^0.6.0",

59 "express": "^4.21.0",

60 "fuzzysort": "^3.1.0",

61 "iconv-lite": "^0.6.3",

62 "node-fetch": "^3.3.2",

63 "open": "^10.1.2",

src/core/artifacts/tunnel.jsView file

Lines 1-32javascript

1// Quick public tunnels for local preview ports.

2//

3// Wraps zero-config tunnel providers so an ephemeral artifact preview running

4// on http://localhost:<port> can be shared with a temporary public URL:

5// - cloudflared → `cloudflared tunnel --url http://localhost:PORT`

6// (no account needed; prints an https://*.trycloudflare.com URL)

7// - localtunnel → `npx -y localtunnel --port PORT`

8// (prints https://*.loca.lt; fallback when cloudflared absent)

9//

10// The manager spawns the provider, scrapes the public URL from its output, and

src/core/routines/runner.jsView file

Lines 33-73javascript

33} from "#core/stores/routines.js";

34import { nowIso } from "#core/util/time.js";

36// --------------------- handlers ---------------------------------------------

38async function handleHeartbeat(ctx, routine) {

src/core/http-tools/browser.jsView file

Lines 381-421javascript

381 if (!code) throw new Error("code required");

382 return onPage((page) => evaluateOnPage(page, code));

383}

src/interfaces/web/dist/assets/index-YFsZFhM6.jsView file

59L60: Please change the parent <Route path="${C}"> to <Route path="${C==="/"?"*":`${C}/*`}">.`)}let g=ss(),b;if(t){let C=typeof t=="string"?di(t):t;rn(m==="/"||C.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-YFsZFhM6.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/asset/pulse-a.wavView file

•path = src/interfaces/tui/asset/pulse-a.wav kind = high_entropy_blob sizeBytes = 176444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/tui/asset/pulse-a.wavView on unpkg

src/core/mcp/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agentprojectcontext/apx@1.65.0 matchedIdentity = npm:[redacted]:1.65.0 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/mcp/runner.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code