@agentprojectcontext/apx@1.76.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@agentprojectcontext/apx@1.76.0: Suspicious npm security report | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/interfaces/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/interfaces/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/core/artifacts/tunnel.jsView file

12// on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

src/core/artifacts/tunnel.jsView on unpkg · L12

6// (no account needed; prints an https://*.trycloudflare.com URL) L7: // - localtunnel → `npx -y localtunnel --port PORT` L8: // (prints https://*.loca.lt; fallback when cloudflared absent) ... L12: // on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/artifacts/tunnel.jsView on unpkg · L6

src/core/routines/runner.jsView file

53L54: async function handleExecAgent(ctx, routine) { L55: const { project, globalConfig } = ctx;

High

Shell

Package source references shell execution.

src/core/routines/runner.jsView on unpkg · L53

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/core/routines/runner.js matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/routines/runner.jsView on unpkg

src/core/http-tools/browser.jsView file

401// eslint-disable-next-line no-new-func L402: result = await page.evaluate(new Function(code)); L403: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/http-tools/browser.jsView on unpkg · L401

src/interfaces/web/dist/assets/index-Bjlk9ttU.jsView file

59L60: Please change the parent <Route path="${k}"> to <Route path="${k==="/"?"*":`${k}/*`}">.`)}let h=ns(),b;if(t){let k=typeof t=="string"?ci(t):t;cn(m==="/"||k.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-Bjlk9ttU.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/core/desktop/autostart.js matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/autostart.jsView on unpkg

7// L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L18: import path from "node:path"; L19: import { execFileSync } from "node:child_process"; L20: import { fileURLToPath } from "node:url"; ... L23: const __filename = fileURLToPath(import.meta.url); L24: const __dirname = path.dirname(__filename); L25: ... L89: L90: // The three functions below take `platform` instead of reading process.platform L91: // inline so the unsupported-platform branch is reachable from a test on any

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/core/desktop/autostart.jsView on unpkg · L7

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/host/daemon/api/admin.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/host/daemon/api/admin.js matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg

src/interfaces/tui/context/sdk-apx.tsxView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/interfaces/tui/context/sdk-apx.tsx matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/tui/context/sdk-apx.tsxView on unpkg

src/core/desktop/process.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/core/desktop/process.js matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/process.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 23-63json

23 "skills/",

24 "README.md",

25 "!**/node_modules/**",

26 "!**/e2e/**",

27 "!**/playwright-report/**",

28 "!**/test-results/**",

29 "!**/*.tsbuildinfo"

30 ],

31 "engines": {

32 "node": ">=18"

33 },

34 "scripts": {

35 "start": "node src/host/daemon/index.js",

36 "smoke": "node src/host/daemon/smoke.js",

37 "test": "node --test --test-reporter=spec tests/*.test.js",

38 "build:web": "node scripts/build-web.js",

39 "preflight": "npm test && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit)",

40 "upgrade": "pnpm install && pnpm add -g .",

41 "prepare": "node scripts/install-githooks.js",

42 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

43 "postinstall": "node src/interfaces/cli/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 },

45 "dependencies": {

46 "@modelcontextprotocol/sdk": "^1.29.0",

47 "@opentui/core": "^0.2.16",

48 "@opentui/keymap": "^0.2.16",

49 "@opentui/solid": "^0.2.16",

50 "@solid-primitives/event-bus": "^1.1.3",

51 "@solid-primitives/scheduled": "^1.5.2",

52 "chalk": "^5.6.2",

53 "cli-cursor": "^5.0.0",

54 "cli-sound": "^1.1.3",

55 "clipboardy": "^4.0.0",

56 "cron-parser": "^5.5.0",

57 "effect": "^3.21.2",

58 "esbuild-plugin-solid": "^0.6.0",

59 "express": "^4.21.0",

60 "fuzzysort": "^3.1.0",

61 "iconv-lite": "^0.6.3",

62 "node-fetch": "^3.3.2",

63 "open": "^10.1.2",

src/core/artifacts/tunnel.jsView file

Lines 1-32javascript

1// Quick public tunnels for local preview ports.

2//

3// Wraps zero-config tunnel providers so an ephemeral artifact preview running

4// on http://localhost:<port> can be shared with a temporary public URL:

5// - cloudflared → `cloudflared tunnel --url http://localhost:PORT`

6// (no account needed; prints an https://*.trycloudflare.com URL)

7// - localtunnel → `npx -y localtunnel --port PORT`

8// (prints https://*.loca.lt; fallback when cloudflared absent)

9//

10// The manager spawns the provider, scrapes the public URL from its output, and

src/core/routines/runner.jsView file

Lines 33-73javascript

33} from "#core/stores/routines.js";

34import { nowIso } from "#core/util/time.js";

35

36// --------------------- handlers ---------------------------------------------

37

38async function handleHeartbeat(ctx, routine) {

src/core/http-tools/browser.jsView file

Lines 381-421javascript

381 if (!code) throw new Error("code required");

382 return onPage((page) => evaluateOnPage(page, code));

383}

src/interfaces/web/dist/assets/index-Bjlk9ttU.jsView file

59L60: Please change the parent <Route path="${k}"> to <Route path="${k==="/"?"*":`${k}/*`}">.`)}let h=ns(),b;if(t){let k=typeof t=="string"?ci(t):t;cn(m==="/"||k.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-Bjlk9ttU.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/host/daemon/api/admin.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/host/daemon/api/admin.js matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/admin.jsView on unpkg

src/interfaces/tui/context/sdk-apx.tsxView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/interfaces/tui/context/sdk-apx.tsx matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/tui/context/sdk-apx.tsxView on unpkg

src/core/desktop/process.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.75.0 matchedPath = src/core/desktop/process.js matchedIdentity = npm:[redacted]:1.75.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/process.jsView on unpkg