registry / @agentvox/host / 0.1.46
@agentvox/host@0.1.46
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged payload path restores compressed database replicas rather than executing code, and the package's install hook performs a scoped node-pty permission fix. Host metadata is sent during normal daemon use to the configured service; the xAI key is used for inference at the configured xAI-compatible endpoint.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user launches the host daemon and it connects to its configured proxy.
Impact
The proxy receives host identifiers needed for the host service; no malicious payload execution or credential redirection was established.
Mechanism
The daemon sends username, hostname, and working directory as host metadata; the inspected postinstall helper only adjusts node-pty helper permissions.
AI rationale
The flagged payload path restores compressed database replicas rather than executing code, and the package's install hook performs a scoped node-pty permission fix. Host metadata is sent during normal daemon use to the configured service; the xAI key is used for inference at the configured xAI-compatible endpoint.
Evidence
package.jsonscripts/fix-pty-helper.mjsdist/cli.jsdist/vox.js.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/0/npm-linux/lib/websocket.js.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/0/npm-linux/package.json.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/0/npm-linux/wrapper.mjs.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/0/npm-linux/browser.js.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/1/npm-linux/package.json.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/1/npm-linux/scripts/prebuild.js.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/1/npm-linux/scripts/post-install.js.lpm-dependency-evidence-7742c0af-d76d-4c51-9949-3b2a2bbaf211/1/npm-linux/lib/index.js
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json runs a postinstall helper that searches node-pty prebuilds; the helper only adds the executable bit to its spawn helper.
- When the daemon connects, dist/cli.js sends username, hostname, and working directory as host metadata to the configured proxy; the default is the AgentVox service, and pairing saves the proxy's returned device credentials.
- The xAI API key is read from XAI_API_KEY or ~/.agentvox/xai.key and sent as a bearer token to the configured inference base URL, which defaults to api.x.ai.
- The Vox gzip path handles a peer replica by decompressing it and writing it as a database file; the inspected code does not execute the decoded bytes.
- The inspected ws and qrcode dependency entrypoints expose WebSocket and QR-code functionality; node-pty's install hooks check prebuilds, rebuild native support when needed, and clean its own release directory.
Evidence against
- dist/cli.js transmits host identifiers to the proxy when the daemon connects; source ties this to host metadata for the product's service.
Behavioral surface
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "node:path";
L14: import { spawn, spawnSync } from "node:child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j2 = await r.json();
L24: return typeof j2.version === "string" ? j2.version : null;
...
L45: var defaultReExec = () => {
L46: const label = process.env.XPC_SERVICE_NAME;
L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") {
L48: try {
L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13Findings
2 Critical6 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @agentvox/host@0.1.46.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.