registry / @agentvox/host / 0.1.44
@agentvox/host@0.1.44
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 4d ago · by lpm-firewall-aiSource inspection found a product-aligned postinstall permission fix and runtime requests to the AgentVox proxy and configured inference service. The scanner’s payload-execution hint corresponds to compressed database synchronization written to a local file, not code execution.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package runs its postinstall helper; starting the CLI or voice daemon activates their runtime network functions.
Impact
The inspected behavior supports terminal setup, host coordination, and inference. No independent credential theft or remote payload execution was established.
Mechanism
The postinstall helper checks node-pty helper files and adds executable permission when needed. Runtime code sends host metadata to the configured AgentVox proxy and sends inference requests with the API key to the configured inference endpoint; the default endpoint is xAI.
AI rationale
Source inspection found a product-aligned postinstall permission fix and runtime requests to the AgentVox proxy and configured inference service. The scanner’s payload-execution hint corresponds to compressed database synchronization written to a local file, not code execution.
Evidence
scripts/fix-pty-helper.mjs
Network endpoints2
proxy.agentvox.botapi.x.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI entrypoints and a postinstall helper; that helper fixes executable permissions on node-pty’s spawn helper.
- The inspected dependency hooks build or clean native terminal artifacts, and the WebSocket and QR code dependencies expose their expected library entrypoints.
- The compressed Vox payload is written as a local database snapshot, while host metadata is sent to the configured AgentVox proxy.
- The CLI sends its API key as a bearer credential to its configured inference endpoint, whose default is xAI.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "node:path";
L14: import { spawn, spawnSync } from "node:child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j2 = await r.json();
L24: return typeof j2.version === "string" ? j2.version : null;
...
L45: var defaultReExec = () => {
L46: const label = process.env.XPC_SERVICE_NAME;
L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") {
L48: try {
L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13Findings
3 Critical6 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
Medium
Affected versions and remediation
This report applies to @agentvox/host@0.1.44.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.44 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.