registry / @agentvox/host / 0.1.45
@agentvox/host@0.1.45
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged host metadata collection and network activity are connected to the package's pairing and shared roster workflow. The inspected lifecycle hooks perform local helper or native dependency setup, and no concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The host begins pairing when a user runs the host command; voice metadata is collected when its daemon starts.
Impact
The inspected behavior supports pairing, roster coordination, and inference; no unrelated credential transfer or other confirmed attack surface was established.
Mechanism
The host communicates with its configured AgentVox proxy, while the voice process collects local host metadata for the assistant roster. The XAI key is sent through the provider client to its configured API base URL.
AI rationale
The flagged host metadata collection and network activity are connected to the package's pairing and shared roster workflow. The inspected lifecycle hooks perform local helper or native dependency setup, and no concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the host and voice command line entrypoints; its postinstall runs a helper that only makes node-pty's spawn helper executable when needed.
- The host pairs through the configured AgentVox proxy, receives a pairing token, and saves it for the daemon's connection.
- The voice process gathers username, hostname, and working directory as metadata for the shared assistant roster.
- The XAI key is used by an OpenAI-compatible client whose base URL defaults to the provider setting and can be changed through XAI_BASE_URL.
- The inspected node-pty install hooks run its prebuild or native build setup and post-install release-folder cleanup; the inspected ws and qrcode files provide their expected library functionality.
Evidence against
- The voice process collects local identity fields and uses network requests, but the inspected source ties those fields to roster metadata and the AgentVox host service workflow.
- The package and node-pty dependency have install hooks, but the inspected hooks perform local helper permission repair or native dependency setup rather than unrelated consumer or agent configuration changes.
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "node:path";
L14: import { spawn, spawnSync } from "node:child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j2 = await r.json();
L24: return typeof j2.version === "string" ? j2.version : null;
...
L45: var defaultReExec = () => {
L46: const label = process.env.XPC_SERVICE_NAME;
L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") {
L48: try {
L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13Findings
3 Critical6 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
Medium
Affected versions and remediation
This report applies to @agentvox/host@0.1.45.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.