Loading npm security reports…

@agentprojectcontext/apx@1.94.2: AI-agent control-surface risk | LPM Firewall

registry / @agentprojectcontext/apx / 1.94.2

@agentprojectcontext/apx@1.94.2

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation changes global AI-agent skill directories and can obtain installed skill content remotely. This is an unconsented broad AI-agent control-surface mutation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

Can alter instructions loaded by multiple AI-agent tools for the current user.

Mechanism

Fetches and writes skills into home-directory agent configuration paths.

Policy narrative

Installing the package automatically invokes its postinstall hook. That hook refreshes skill content, including from raw.githubusercontent.com, then writes it into Claude, Cursor, Codex, and generic agent skill directories under the user's home directory. The hook has no runtime check restricting this mutation to an explicitly requested setup action or to global installs.

AI rationale

The automatic postinstall hook mutates several foreign AI-agent control surfaces and accepts remotely fetched instruction content. This meets the install-hook abuse blocking rule.

Evidence

package.jsonsrc/interfaces/cli/postinstall.jssrc/core/apc/scaffold.jssrc/core/apc/skill-sync.js~/.claude/skills/<slug>/SKILL.md~/.cursor/skills/<slug>/SKILL.md~/.codex/skills/<slug>/SKILL.md~/.agents/skills/<slug>/SKILL.mdskills/apc-context/SKILL.md

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/interfaces/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/interfaces/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/core/artifacts/tunnel.jsView file

12// on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

src/core/artifacts/tunnel.jsView on unpkg · L12

6// (no account needed; prints an https://*.trycloudflare.com URL) L7: // - localtunnel → `npx -y localtunnel --port PORT` L8: // (prints https://*.loca.lt; fallback when cloudflared absent) ... L12: // on daemon exit. L13: import { spawn, spawnSync } from "node:child_process"; L14: import { randomUUID } from "node:crypto";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/artifacts/tunnel.jsView on unpkg · L6

src/core/net/tailscale.jsView file

45try { L46: const found = execFileSync("command", ["-v", "tailscale"], { shell: true, encoding: "utf8" }).trim(); L47: if (found) return (cachedBinary = found);

High

Shell

Package source references shell execution.

src/core/net/tailscale.jsView on unpkg · L45

src/core/http-tools/browser.jsView file

730// eslint-disable-next-line no-new-func L731: result = await page.evaluate(new Function(code)); L732: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/http-tools/browser.jsView on unpkg · L730

src/core/voice/transcription.js#virtual:normalized:round1View file

52* else faster-whisper cpu. L53: * Safety net: if the chosen mlx model isn"t downloaded yet, fall back to\n * faster-whisper so a live voice turn never stalls on a multi-GB download —\n * the model-manager UI hand... L54: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/core/voice/transcription.js#virtual:normalized:round1View on unpkg · L52

src/core/channels/whatsapp/stickers.jsView file

36* L37: * The key is base64 of WhatsApp's content hash, so it carries "/" and "+" — a L38: * path built from it straight would escape the directory on the first slash. ... L309: // sticker came back unnamed and nothing said why. L310: images: [{ data: fs.readFileSync(localPath).toString("base64"), mime }], L311: }],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/channels/whatsapp/stickers.jsView on unpkg · L36

src/core/desktop/autostart.jsView file

7Trigger-reachable persistence chain: scripts.start -> src/host/daemon/index.js -> src/host/daemon/api.js -> src/host/daemon/api/desktop.js -> src/core/desktop/autostart.js L7: // L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L19: import { DESKTOP_AUTOSTART_LOG_PATH } from "#core/config/paths.js"; L20: import { execFileSync } from "node:child_process"; L21: import { fileURLToPath } from "node:url"; ... L24: const __filename = fileURLToPath(import.meta.url); L25: const __dirname = path.dirname(__filename); L26: ... L90: L91: // The three functions below take `platform` instead of reading process.platform L92: // inline so the unsupported-platform branch is reachable fro

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/core/desktop/autostart.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.81.0 matchedPath = src/core/desktop/autostart.js matchedIdentity = npm:[redacted]:1.81.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/autostart.jsView on unpkg

7// L8: // macOS → ~/Library/LaunchAgents/dev.apx.desktop.plist + launchctl load -w L9: // win32 → HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APXDesktop ... L19: import { DESKTOP_AUTOSTART_LOG_PATH } from "#core/config/paths.js"; L20: import { execFileSync } from "node:child_process"; L21: import { fileURLToPath } from "node:url"; ... L24: const __filename = fileURLToPath(import.meta.url); L25: const __dirname = path.dirname(__filename); L26: ... L90: L91: // The three functions below take `platform` instead of reading process.platform L92: // inline so the unsupported-platform branch is reachable from a test on any

src/interfaces/cli/http.jsView file

7import fs from "node:fs"; L8: import nodeHttp from "node:http"; L9: import os from "node:os"; ... L11: import { TOKEN_PATH, LOG_PATH } from "#core/config/paths.js"; L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url"; ... L17: L18: const DEFAULT_PORT = parseInt(process.env.APX_PORT || "7430", 10); L19: const DEFAULT_HOST = process.env.APX_HOST || "127.0.0.1";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/interfaces/cli/http.jsView on unpkg · L7

src/host/daemon/pty-bridge.pyView file

•path = src/host/daemon/pty-bridge.py kind = build_helper sizeBytes = 3335 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/host/daemon/pty-bridge.pyView on unpkg

src/interfaces/web/dist/sw.js.gzView file

•path = src/interfaces/web/dist/sw.js.gz kind = compressed_blob sizeBytes = 1818 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

src/interfaces/web/dist/sw.js.gzView on unpkg

src/interfaces/web/dist/assets/index-BhXHey_a.js.map.gzView file

•path = [redacted]-BhXHey_a.js.map.gz kind = high_entropy_blob sizeBytes = 1863545 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/interfaces/web/dist/assets/index-BhXHey_a.js.map.gzView on unpkg

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 47505 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

src/interfaces/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

src/core/http-tools/browser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/core/http-tools/browser.js#virtual:normalized:round1View on unpkg

src/core/desktop/process.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.81.0 matchedPath = src/core/desktop/process.js matchedIdentity = npm:[redacted]:1.81.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/desktop/process.jsView on unpkg

src/core/voice/engines/gemini.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.81.0 matchedPath = src/core/voice/engines/gemini.js matchedIdentity = npm:[redacted]:1.81.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/voice/engines/gemini.jsView on unpkg

src/host/daemon/deck-exec.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.81.0 matchedPath = src/host/daemon/deck-exec.js matchedIdentity = npm:[redacted]:1.81.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/daemon/deck-exec.jsView on unpkg

src/core/http-tools/search.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.81.0 matchedPath = src/core/http-tools/search.js matchedIdentity = npm:[redacted]:1.81.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/http-tools/search.jsView on unpkg

src/core/mcp/runner.jsView file

•matchType = normalized_sha256 matchedPackage = @agentprojectcontext/apx@1.81.0 matchedPath = src/core/mcp/runner.js matchedIdentity = npm:[redacted]:1.81.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/mcp/runner.jsView on unpkg