registry / @agentvox/host / 0.1.27
@agentvox/host@0.1.27
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe scanner's execution and host-data indicators map to product behavior: a targeted node-pty repair, project-scoped agent session handling, pairing, and package self-updates. The inspected source does not establish malicious collection, payload execution, or unauthorized agent configuration changes.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The helper repair runs after installation; pairing, session parsing, and updates occur during package use.
Impact
No confirmed attack impact was established from the inspected source.
Mechanism
The helper changes permissions on node-pty spawn helpers. Runtime code reads configured agent session data and checks for updates to this package.
AI rationale
The scanner's execution and host-data indicators map to product behavior: a targeted node-pty repair, project-scoped agent session handling, pairing, and package self-updates. The inspected source does not establish malicious collection, payload execution, or unauthorized agent configuration changes.
Network endpoints2
proxy.agentvox.botregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The postinstall hook runs a helper that checks node-pty prebuilds and adds executable permission to spawn-helper when needed.
- The Claude session parser looks under project-specific paths in the user's Claude session directory.
- The CLI collects the local username, hostname, and working directory as host metadata.
- Vox enrollment sends its request to the supplied proxy, and normal daemon startup requires an existing configuration.
- The runtime updater checks npm for a newer release of this package and has an environment-variable opt-out.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "path";
L14: import { spawnSync } from "child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j = await r.json();
L24: return typeof j.version === "string" ? j.version : null;
...
L49: const fetchLatest = deps.fetchLatest ?? defaultFetchLatest;
L50: const pinned = process.env.AGENTVOX_VERSION;
L51: const latest = pinned ?? await fetchLatest(deps.pkg);
...
L112: var acquireInstanceLock = (name, log2) => {
L113: const dir = join(homedir(), ".agentvox");
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13•Trigger-reachable chain: manifest.bin -> dist/vox.js
Reachable file contains a blocking source-risk pattern.
Findings
3 Critical4 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @agentvox/host@0.1.27.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.