registry / @agentvox/host / 0.1.42
@agentvox/host@0.1.42
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 13d ago · by lpm-firewall-aiInspected source shows package-aligned LLM and proxy traffic plus a postinstall permission fix for node-pty. The scanner's credential-redirection, remote-payload, and runtime-update claims were not supported by the inspected source paths.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Normal CLI or daemon use; the postinstall helper runs during package installation.
Impact
No unconsented credential disclosure, remote payload execution, or malicious mutation was established.
Mechanism
The CLI sends LLM requests with the supplied xAI key to the configured endpoint. Vox sends host metadata to its configured proxy, and postinstall adjusts a node-pty helper's executable bit.
AI rationale
Inspected source shows package-aligned LLM and proxy traffic plus a postinstall permission fix for node-pty. The scanner's credential-redirection, remote-payload, and runtime-update claims were not supported by the inspected source paths.
Evidence
package.jsonscripts/fix-pty-helper.mjsdist/cli.jsdist/vox.js
Network endpoints2
api.x.ai/v1proxy.agentvox.bot
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the host and Vox command entrypoints; its postinstall runs a helper that only makes node-pty's spawn-helper executable.
- The inspected CLI location looks for Claude project-session directories; this location does not establish credential transfer or external configuration changes.
- The CLI reads the xAI key from its environment variable or local key file, defaults to api.x.ai, and sends the key as bearer authorization to the configured LLM endpoint.
- Vox collects username, hostname, and working directory as host metadata and sends it to the configured proxy; the documented default is proxy.agentvox.bot.
- Vox's entrypoint starts the daemon and only references its update helpers without invoking them.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "node:path";
L14: import { spawn, spawnSync } from "node:child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j2 = await r.json();
L24: return typeof j2.version === "string" ? j2.version : null;
...
L45: var defaultReExec = () => {
L46: const label = process.env.XPC_SERVICE_NAME;
L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") {
L48: try {
L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13Findings
2 Critical6 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @agentvox/host@0.1.42.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.42 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.