registry / @agentvox/host / 0.1.24
@agentvox/host@0.1.24
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 22d ago · by lpm-firewall-aiDirect inspection does not support the scanner's remote asset execution claim: the cited encoding behavior processes JSON messages. The install hook, authenticated metadata exchange, API authentication, and host commands are package-aligned, with no concrete malicious chain identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installation repairs dependency permissions; running the CLI activates pairing or the configured daemon.
Impact
The configured service can control the host and receive operational metadata as part of the package's function; inspected source does not establish covert exfiltration or malicious agent configuration mutation.
Mechanism
The daemon exchanges JSON messages and executes remote-control requests through its configured connection; no remote asset decoding into executable code was found.
AI rationale
Direct inspection does not support the scanner's remote asset execution claim: the cited encoding behavior processes JSON messages. The install hook, authenticated metadata exchange, API authentication, and host commands are package-aligned, with no concrete malicious chain identified.
Network endpoints3
proxy.agentvox.botapi.x.ai/v1registry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no runtime self-dependency; its postinstall script repairs node-pty helper permissions.
- The flagged Claude integration reads project session history; inspected configuration writes use AgentVox-owned paths.
- Base64 payloads in dist/vox.js are parsed as JSON protocol messages, without dynamic code execution.
- Host metadata is sent through the enrolled configuration's authenticated AgentVox connection.
- Command execution handles host requests through the configured daemon connection, consistent with its remote-control function.
- Inference uses a caller-configured API client and explicitly supplied API key, defaulting to the intended xAI service.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "path";
L14: import { spawnSync } from "child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j = await r.json();
L24: return typeof j.version === "string" ? j.version : null;
...
L49: const fetchLatest = deps.fetchLatest ?? defaultFetchLatest;
L50: const pinned = process.env.AGENTVOX_VERSION;
L51: const latest = pinned ?? await fetchLatest(deps.pkg);
...
L112: var acquireInstanceLock = (name, log2) => {
L113: const dir = join(homedir(), ".agentvox");
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13•Trigger-reachable chain: manifest.bin -> dist/vox.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical4 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @agentvox/host@0.1.24.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.