registry / @agentrix/cli / 0.46.0

@agentrix/cli@0.46.0

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 10 file(s), 1.56 MB of source, external domains: agentrix.xmz.ai, github.com, registry.npmjs.org

Source & flagged code

7 flagged

package.jsonView file

Lines 35-75json

35 }

36 }

37 },

38 "files": [

39 "dist",

40 "bin",

41 "scripts",

42 "package.json"

43 ],

44 "scripts": {

45 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary",

46 "typecheck": "tsc --noEmit --skipLibCheck 2>&1 | (grep -v 'node_modules/effect' | grep -v 'Symbol.dispose' || true)",

47 "build": "shx rm -rf dist && tsc --noEmit --skipLibCheck 2>&1 | (grep -v 'node_modules/effect' | grep -v 'Symbol.dispose' || true) && pkgroll && shx mkdir -p dist/sandbox && shx cp src/sandbox/node-proxy-boot.cjs dist/sandbox/ && shx mkdir -p dist/migrations && shx cp src/worker/history/migrations/*.sql dist/migrations/ && node scripts/minify-dist.mjs",

48 "prod": "node --env-file=.env ./bin/agentrix.mjs",

49 "test": "yarn build && tsx --env-file .env.integration-test \"$(yarn -s bin vitest)\" run",

50 "dev": "yarn build && tsx --env-file .env.dev src/index.ts",

51 "local": "yarn build && tsx --env-file .env.local src/index.ts",

52 "prod-local": "yarn build && tsx --env ./bin/agentrix.mjs",

53 "prepublishOnly": "yarn build && yarn test",

54 "release": "release-it",

55 "postinstall": "node scripts/ensure-better-sqlite3.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

56 "lint": "eslint 'src/**/*.{js,ts}' --fix"

57 },

58 "pkgroll": {

59 "minify": true,

60 "sourcemap": false

61 },

62 "dependencies": {

63 "@agentrix/shared": "^2.43.0",

64 "@anthropic-ai/claude-agent-sdk": "^0.2.133",

65 "@anthropic-ai/sdk": "0.71.2",

66 "@larksuiteoapi/node-sdk": "^1.63.1",

67 "@modelcontextprotocol/sdk": "^1.15.1",

68 "@openai/codex-sdk": "^0.141.0",

69 "@stablelib/base64": "^2.0.1",

70 "@stablelib/hex": "^2.0.1",

71 "@types/better-sqlite3": "^7.6.13",

72 "@types/cross-spawn": "^6.0.6",

73 "@types/http-proxy": "^1.17.16",

74 "@types/ps-list": "^6.2.1",

75 "@types/qrcode-terminal": "^0.12.2",

bin/agentrix.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/agentrix.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

dist/index.cjsView file

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.cjsView on unpkg · L1

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.cjsView on unpkg · L1

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/ensure-better-sqlite3.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/agentrix.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/agentrix.mjsView on unpkg · L2

7// Check if we're already running with the flags L8: const hasNoWarnings = process.execArgv.includes('--no-warnings'); L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/agentrix.mjsView on unpkg · L7

2Cross-file remote execution chain: bin/agentrix.mjs spawns dist/index.mjs; helper contains network access plus dynamic code execution. L2: L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url'; ... L24: stdio: 'inherit', L25: env: process.env L26: });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentrix.mjsView on unpkg · L2

dist/index.cjsView file

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.cjsView on unpkg · L1

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.cjsView on unpkg · L1

Findings

6 High3 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/agentrix.mjs

HighShellbin/agentrix.mjs

HighSame File Env Network Executiondist/index.cjs

HighCommand Output Exfiltrationdist/index.cjs

HighCross File Remote Execution Contextbin/agentrix.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/index.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

package.jsonView file

Lines 35-75json

35 }

36 }

37 },

38 "files": [

39 "dist",

40 "bin",

41 "scripts",

42 "package.json"

43 ],

44 "scripts": {

45 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary",

46 "typecheck": "tsc --noEmit --skipLibCheck 2>&1 | (grep -v 'node_modules/effect' | grep -v 'Symbol.dispose' || true)",

48 "prod": "node --env-file=.env ./bin/agentrix.mjs",

49 "test": "yarn build && tsx --env-file .env.integration-test \"$(yarn -s bin vitest)\" run",

50 "dev": "yarn build && tsx --env-file .env.dev src/index.ts",

51 "local": "yarn build && tsx --env-file .env.local src/index.ts",

52 "prod-local": "yarn build && tsx --env ./bin/agentrix.mjs",

53 "prepublishOnly": "yarn build && yarn test",

54 "release": "release-it",

55 "postinstall": "node scripts/ensure-better-sqlite3.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

56 "lint": "eslint 'src/**/*.{js,ts}' --fix"

57 },

58 "pkgroll": {

59 "minify": true,

60 "sourcemap": false

61 },

62 "dependencies": {

63 "@agentrix/shared": "^2.43.0",

64 "@anthropic-ai/claude-agent-sdk": "^0.2.133",

65 "@anthropic-ai/sdk": "0.71.2",

66 "@larksuiteoapi/node-sdk": "^1.63.1",

67 "@modelcontextprotocol/sdk": "^1.15.1",

68 "@openai/codex-sdk": "^0.141.0",

69 "@stablelib/base64": "^2.0.1",

70 "@stablelib/hex": "^2.0.1",

71 "@types/better-sqlite3": "^7.6.13",

72 "@types/cross-spawn": "^6.0.6",

73 "@types/http-proxy": "^1.17.16",

74 "@types/ps-list": "^6.2.1",

75 "@types/qrcode-terminal": "^0.12.2",

bin/agentrix.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/agentrix.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

dist/index.cjsView file

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.cjsView on unpkg · L1

1"use strict";var os=require("node:os"),fs=require("node:fs"),path=require("node:path"),yargs=require("yargs"),helpers=require("yargs/helpers"),chalk=require("chalk"),shared=require...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.cjsView on unpkg · L1