@agentvox/host@0.1.41

AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Source inspection found a postinstall fix limited to the package’s node-pty helper and runtime metadata sent to the configured AgentVox proxy for coordination. The scanner’s stronger claims were not established by the inspected source.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the configured Vox daemon.

Impact

The inspected source shows product-aligned metadata sharing, with no confirmed harmful effect.

Mechanism

The daemon sends the username, hostname, and working directory as host metadata when its proxy connection opens.

AI rationale

Evidence

package.jsonscripts/fix-pty-helper.mjsdist/cli.jsdist/vox.js

Network endpoints1

proxy.agentvox.bot

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json routes the host and Vox commands to dist entrypoints and defines a postinstall helper.
The postinstall helper searches adjacent node-pty installs and only adds the executable bit to their spawn-helper.
At the flagged CLI location, the code checks local Claude project-history paths.
Vox collects the username, hostname, and working directory as host metadata for assistant coordination.
The configured Vox daemon sends that metadata to its configured proxy; the default is the AgentVox proxy, and the daemon runs after configuration or pairing.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 336 KB of source, external domains: api.github.com, api.x.ai, proxy.agentvox.bot, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/fix-pty-helper.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/vox.jsView file

13import { join } from "node:path"; L14: import { spawn, spawnSync } from "node:child_process"; L15: var REGISTRY = "https://registry.npmjs.org"; L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3; ... L22: return null; L23: const j2 = await r.json(); L24: return typeof j2.version === "string" ? j2.version : null; ... L45: var defaultReExec = () => { L46: const label = process.env.XPC_SERVICE_NAME; L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") { L48: try { L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/vox.jsView on unpkg · L13

Findings

2 Critical6 High5 Medium5 Low

CriticalRemote Asset Decode Executedist/vox.js

CriticalTrigger Reachable Dangerous Capabilitydist/vox.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/vox.js

HighHost Fingerprint Exfiltrationdist/vox.js

HighCredential Redirect Persistencedist/cli.js

HighSandbox Evasion Gated Capabilitydist/vox.js

HighRuntime Package Installdist/vox.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-systemd.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

Affected versions and remediation

This report applies to @agentvox/host@0.1.41.

See all versions of @agentvox/host for other recorded verdicts.

Review the evidence and your use of @agentvox/host@0.1.41 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 14:30:24.659Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.