@agentvox/host@0.1.29

AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source inspection found package-aligned daemon behavior and a narrowly scoped postinstall permission fix. The scanner's payload-execution concern is not supported by the inspected source: the relevant base64 path parses JSON envelopes rather than executing decoded code.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The permission fix runs at postinstall; daemon activity begins when the user launches the host or Vox service.

Impact

No malicious impact was established from these behaviors.

Mechanism

The helper only adds execute permission to node-pty's spawn helper. Agent activity reads are request-driven, and Vox metadata is sent through the configured proxy.

AI rationale

Evidence

package.jsonscripts/fix-pty-helper.mjsdist/cli.jsdist/vox.js

Network endpoints1

proxy.agentvox.bot

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest's postinstall hook runs a helper that only restores execute permission on node-pty's spawn helper.
The flagged CLI location reads local Claude project logs for agent activity requests; recent results are capped and returned to the requesting peer.
Vox sends username, hostname, and working directory as host metadata through its configured proxy; its default proxy is the AgentVox service.
The inspected base64 envelope path parses JSON; it does not execute the decoded content.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 223 KB of source, external domains: api.x.ai, proxy.agentvox.bot, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/fix-pty-helper.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/vox.jsView file

13import { join } from "path"; L14: import { spawnSync } from "child_process"; L15: var REGISTRY = "https://registry.npmjs.org"; L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3; ... L22: return null; L23: const j = await r.json(); L24: return typeof j.version === "string" ? j.version : null; ... L49: const fetchLatest = deps.fetchLatest ?? defaultFetchLatest; L50: const pinned = process.env.AGENTVOX_VERSION; L51: const latest = pinned ?? await fetchLatest(deps.pkg); ... L112: var acquireInstanceLock = (name, log2) => { L113: const dir = join(homedir(), ".agentvox");

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/vox.jsView on unpkg · L13

•Trigger-reachable chain: manifest.bin -> dist/vox.js Reachable file contains a blocking source-risk pattern.

Findings

3 Critical4 High5 Medium5 Low

CriticalRemote Asset Decode Executedist/vox.js

CriticalTrigger Reachable Dangerous Capabilitydist/vox.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/vox.js

HighHost Fingerprint Exfiltrationdist/vox.js

HighRuntime Package Installdist/vox.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-systemd.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

Low

Affected versions and remediation

This report applies to @agentvox/host@0.1.29.

See all versions of @agentvox/host for other recorded verdicts.

Review the evidence and your use of @agentvox/host@0.1.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 03:41:43.492Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.