registry / @agentvox/host / 0.1.14
@agentvox/host@0.1.14
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall behavior is limited to making node-pty's spawn-helper executable. Remote control, approval bypass, and proxy traffic are explicit CLI features of this hands-free host, not an unconsented install hook.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User invocation of the agentvox-host or agentvox-vox binaries, not npm install.
Impact
No unconsented mutation of a foreign agent control surface, credential theft, or install-time payload execution was identified.
Mechanism
The install hook chmods spawn-helper. Session-log reads and agent launches occur only inside the running daemon.
AI rationale
Install behavior is limited to making node-pty's spawn-helper executable. Remote control, approval bypass, and proxy traffic are explicit CLI features of this hands-free host, not an unconsented install hook.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only npm lifecycle hook is postinstall, which runs scripts/fix-pty-helper.mjs to chmod node-pty spawn-helper when the executable bit is missing.
- dist/cli.js starts pairing or the host daemon only from main() after the agentvox-host binary is invoked; install does not start it.
- dist/vox.js stores its own config under ~/.agentvox/vox.json. The ~/.claude/projects read in dist/cli.js is a local session-log parser used while the host is running, not an install-time write to Claude or Codex config.
- package.json does not depend on itself and has no preinstall hook.
Evidence against
- After the user runs the host, it can launch claude or codex with approval-bypass flags and connect to the configured AgentVox proxy. That matches the stated hands-free control product.
- While the daemon is running it may npm-install a newer global @agentvox/host unless AGENTVOX_AUTO_UPDATE=0. That path is opt-out, selects a newer registry release, and is not an install-time self-dependency.
Behavioral surface
ChildProcessCrypto
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
21var resolvePipelineKind = (config) => {
L22: const env = process.env.AGENTVOX_VOX_PIPELINE?.toLowerCase();
L23: const raw = env ?? config.pipeline ?? "cascaded";
...
L25: };
L26: var defaultConfigPath = () => process.env.AGENTVOX_VOX_CONFIG ?? join(homedir(), ".agentvox", "vox.json");
L27: var loadConfig = (path = defaultConfigPath()) => {
L28: if (!existsSync(path)) return null;
L29: const raw = JSON.parse(readFileSync(path, "utf8"));
L30: return {
...
L45: // ../vox/src/client.ts
L46: import { WebSocket } from "ws";
L47: var noopLog = () => {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L21•Trigger-reachable chain: manifest.bin -> dist/vox.js
Reachable file contains a blocking source-risk pattern.
Findings
3 Critical4 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @agentvox/host@0.1.14.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.