@agentvox/host@0.1.47

⚠ Under review

AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected postinstall helper performs a targeted executable-permission fix, and the flagged credential and payload behaviors were not confirmed. The declared node-pty dependency source is unavailable in the snapshot, so a clean verdict is not supported.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing or running the package would use its declared node-pty dependency.

Impact

The dependency's behavior cannot be assessed from this snapshot; no attack impact was confirmed.

Mechanism

The available source does not establish what the unavailable dependency does during installation or runtime.

AI rationale

Evidence

package.json

Decision evidence

public snapshot

AI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares node-pty as a runtime dependency, but its source is absent from the available package snapshot, so its install behavior could not be reviewed.
The postinstall hook runs a helper that checks node-pty spawn-helper files and corrects executable permissions.
The inference client uses the configured API base URL; no unrelated credential recipient was confirmed.

Evidence against

The inspected postinstall helper only adjusts executable permissions on node-pty helper files.
The inspected entrypoints show no confirmed remote payload execution or credential theft.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 340 KB of source, external domains: api.github.com, api.x.ai, proxy.agentvox.bot, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/fix-pty-helper.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/vox.jsView file

13import { join } from "node:path"; L14: import { spawn, spawnSync } from "node:child_process"; L15: var REGISTRY = "https://registry.npmjs.org"; L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3; ... L22: return null; L23: const j2 = await r.json(); L24: return typeof j2.version === "string" ? j2.version : null; ... L45: var defaultReExec = () => { L46: const label = process.env.XPC_SERVICE_NAME; L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") { L48: try { L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/vox.jsView on unpkg · L13

Findings

2 Critical6 High5 Medium5 Low

CriticalRemote Asset Decode Executedist/vox.js

CriticalTrigger Reachable Dangerous Capabilitydist/vox.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/vox.js

HighHost Fingerprint Exfiltrationdist/vox.js

HighCredential Redirect Persistencedist/cli.js

HighSandbox Evasion Gated Capabilitydist/vox.js

HighRuntime Package Installdist/vox.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-systemd.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

Affected versions and remediation

This report applies to @agentvox/host@0.1.47.

See all versions of @agentvox/host for other recorded verdicts.

Review the evidence and your use of @agentvox/host@0.1.47 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-25 18:58:02.946Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.