Loading npm security reports…

@agentprojectcontext/apx@1.78.0: AI-agent control-surface risk | LPM Firewall

registry / @agentprojectcontext/apx / 1.78.0

@agentprojectcontext/apx@1.78.0

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall writes APX-controlled instruction files into broad, foreign AI-agent global skill directories. It also refreshes one skill from a mutable remote GitHub main URL before installation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install, including dependency installation that runs postinstall

Impact

Alters Claude, Cursor, Codex, and other agent behavior without an explicit setup command; future remote content can be propagated at install time.

Mechanism

install-time remote skill refresh and global AI-agent instruction injection

Policy narrative

During npm postinstall, the package refreshes a skill from a mutable GitHub main branch and installs its bundled skills into global Claude, Cursor, Codex, and generic agent directories. This changes unrelated AI-agent control surfaces without user invocation and can overwrite or prune prior APX entries. The installed context skill contains imperative agent instructions, so remotely changed content can influence agent behavior on subsequent installs.

Rationale

This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, compounded by mutable remote instruction retrieval. It meets the blocking policy even though ordinary runtime network use appears package-aligned.

Evidence

package.jsonsrc/interfaces/cli/postinstall.jssrc/core/apc/scaffold.jssrc/core/apc/skill-sync.jsskills/apc-context/SKILL.md~/.claude/skills/<slug>/SKILL.md~/.cursor/skills/<slug>/SKILL.md

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/interfaces/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/interfaces/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/core/artifacts/tunnel.jsView file

12// on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

src/core/artifacts/tunnel.jsView on unpkg · L12

6// (no account needed; prints an https://*.trycloudflare.com URL) L7: // - localtunnel → `npx -y localtunnel --port PORT` L8: // (prints https://*.loca.lt; fallback when cloudflared absent) ... L12: // on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/artifacts/tunnel.jsView on unpkg · L6

src/core/routines/runner.jsView file

53L54: async function handleExecAgent(ctx, routine) { L55: const { project, globalConfig } = ctx;

High

Shell

Package source references shell execution.

src/core/routines/runner.jsView on unpkg · L53

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/core/routines/runner.js matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/routines/runner.jsView on unpkg

src/core/http-tools/browser.jsView file

401// eslint-disable-next-line no-new-func L402: result = await page.evaluate(new Function(code)); L403: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/http-tools/browser.jsView on unpkg · L401

src/interfaces/web/dist/assets/index-CBR_-QyA.jsView file

59L60: Please change the parent <Route path="${k}"> to <Route path="${k==="/"?"*":`${k}/*`}">.`)}let h=ns(),b;if(t){let k=typeof t=="string"?cl(t):t;cn(m==="/"||k.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-CBR_-QyA.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

7// L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L19: import { DESKTOP_AUTOSTART_LOG_PATH } from "#core/config/paths.js"; L20: import { execFileSync } from "node:child_process"; L21: import { fileURLToPath } from "node:url"; ... L24: const __filename = fileURLToPath(import.meta.url); L25: const __dirname = path.dirname(__filename); L26: ... L90: L91: // The three functions below take `platform` instead of reading process.platform L92: // inline so the unsupported-platform branch is reachable from a test on any

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/core/desktop/autostart.jsView on unpkg · L7

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/context/sdk-apx.tsxView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/interfaces/tui/context/sdk-apx.tsx matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/tui/context/sdk-apx.tsxView on unpkg

src/core/voice/engines/gemini.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/core/voice/engines/gemini.js matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/voice/engines/gemini.jsView on unpkg

src/host/daemon/api/skills.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/host/daemon/api/skills.js matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/skills.jsView on unpkg

src/host/daemon/deck-exec.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/host/daemon/deck-exec.js matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/deck-exec.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 27-67json

27 "!**/playwright-report/**",

28 "!**/test-results/**",

29 "!**/*.tsbuildinfo"

30 ],

31 "engines": {

32 "node": ">=22"

33 },

34 "scripts": {

35 "start": "node src/host/daemon/index.js",

36 "smoke": "node src/host/daemon/smoke.js",

37 "test": "node --test --test-reporter=spec tests/*.test.js",

38 "test:ci": "node scripts/test-ci.js",

39 "lint": "eslint .",

40 "lint:fix": "eslint . --fix",

41 "typecheck:tui": "node scripts/typecheck-tui.js",

42 "build:web": "node scripts/build-web.js",

43 "preflight": "npm run lint && npm run test:ci && node scripts/build-web.js && (cd src/interfaces/web && npx --no-install tsc --noEmit) && npm run typecheck:tui",

44 "upgrade": "pnpm install && pnpm add -g .",

45 "prepare": "node scripts/install-githooks.js && node scripts/sync-apc-skill.js",

46 "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",

47 "postinstall": "node src/interfaces/cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "smoke:seam": "node --test --test-reporter=spec tests/smoke/*.smoke.js"

49 },

50 "dependencies": {

51 "@modelcontextprotocol/sdk": "^1.29.0",

52 "@opentui/core": "^0.2.16",

53 "@opentui/keymap": "^0.2.16",

54 "@opentui/solid": "^0.2.16",

55 "@solid-primitives/event-bus": "^1.1.3",

56 "@solid-primitives/scheduled": "^1.5.2",

57 "cli-sound": "^1.1.3",

58 "clipboardy": "^4.0.0",

59 "cron-parser": "^5.5.0",

60 "effect": "^3.21.2",

61 "express": "^4.21.0",

62 "fuzzysort": "^3.1.0",

63 "node-fetch": "^3.3.2",

64 "open": "^10.1.2",

65 "opentui-spinner": "^0.0.6",

66 "qrcode-terminal": "^0.12.0",

67 "remeda": "^2.21.0",

src/core/artifacts/tunnel.jsView file

Lines 1-32javascript

1// Quick public tunnels for local preview ports.

2//

3// Wraps zero-config tunnel providers so an ephemeral artifact preview running

4// on http://localhost:<port> can be shared with a temporary public URL:

5// - cloudflared → `cloudflared tunnel --url http://localhost:PORT`

6// (no account needed; prints an https://*.trycloudflare.com URL)

7// - localtunnel → `npx -y localtunnel --port PORT`

8// (prints https://*.loca.lt; fallback when cloudflared absent)

9//

10// The manager spawns the provider, scrapes the public URL from its output, and

src/core/routines/runner.jsView file

Lines 33-73javascript

33} from "#core/stores/routines.js";

34import { nowIso } from "#core/util/time.js";

35

36// --------------------- handlers ---------------------------------------------

37

38async function handleHeartbeat(ctx, routine) {

src/core/http-tools/browser.jsView file

Lines 381-421javascript

381 if (!code) throw new Error("code required");

382 return onPage((page) => evaluateOnPage(page, code));

383}

src/interfaces/web/dist/assets/index-CBR_-QyA.jsView file

59L60: Please change the parent <Route path="${k}"> to <Route path="${k==="/"?"*":`${k}/*`}">.`)}let h=ns(),b;if(t){let k=typeof t=="string"?cl(t):t;cn(m==="/"||k.pathname?.startsWith(m),... L61: * @license lucide-react v0.469.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/interfaces/web/dist/assets/index-CBR_-QyA.jsView on unpkg · L59

src/core/desktop/autostart.jsView file

Lines 1-27javascript

1// Per-user "launch APX Desktop at login" wiring. Used by BOTH the CLI

2// (`apx desktop install` / `uninstall`) and the daemon's

3// /api/desktop/autostart endpoint so the web admin can toggle the same setting

4// without shelling out.

5//

6// Per-user, never sudo, fully reversible. Three platforms supported:

7//

8// macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w

9// win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop

10// linux → ~/.config/autostart/apx-desktop.desktop

src/host/daemon/whisper-server.pyView file

•path = src/host/daemon/whisper-server.py kind = build_helper sizeBytes = 11207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/whisper-server.pyView on unpkg

src/interfaces/tui/context/sdk-apx.tsxView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/interfaces/tui/context/sdk-apx.tsx matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/interfaces/tui/context/sdk-apx.tsxView on unpkg

src/core/voice/engines/gemini.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/core/voice/engines/gemini.js matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/voice/engines/gemini.jsView on unpkg

src/host/daemon/api/skills.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/host/daemon/api/skills.js matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/api/skills.jsView on unpkg

src/host/daemon/deck-exec.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.77.3 matchedPath = src/host/daemon/deck-exec.js matchedIdentity = npm:[redacted]:1.77.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/deck-exec.jsView on unpkg