registry / @agentvox/host / 0.1.48
@agentvox/host@0.1.48
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 3d ago · by lpm-firewall-aiSource inspection supports the scanner’s credential-transfer and remote-execution hints as ordinary configured service behavior or unsupported by the inspected code. The postinstall helper is scoped to node-pty permissions, and the observed metadata transfer is part of the configured daemon connection.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the host or Vox daemon activates service requests; enrollment requires invoking the command with a proxy URL and optional token.
Impact
No unauthorized credential transfer, unrelated account action, or remote payload execution was established.
Mechanism
The inference client uses its configured endpoint, enrollment uses the supplied proxy, and Vox sends host metadata to its configured proxy. Vox also checks npm for updates and can install a newer release of this package.
AI rationale
Source inspection supports the scanner’s credential-transfer and remote-execution hints as ordinary configured service behavior or unsupported by the inspected code. The postinstall helper is scoped to node-pty permissions, and the observed metadata transfer is part of the configured daemon connection.
Evidence
package.jsonscripts/fix-pty-helper.mjsdist/cli.jsdist/vox.js.lpm-dependency-evidence-7df6effc-6cd5-43c0-bf90-196c037e3b6e/0/npm-linux/lib/websocket.js.lpm-dependency-evidence-7df6effc-6cd5-43c0-bf90-196c037e3b6e/0/npm-linux/package.json.lpm-dependency-evidence-7df6effc-6cd5-43c0-bf90-196c037e3b6e/0/npm-linux/wrapper.mjs.lpm-dependency-evidence-7df6effc-6cd5-43c0-bf90-196c037e3b6e/0/npm-linux/browser.js.lpm-dependency-evidence-7df6effc-6cd5-43c0-bf90-196c037e3b6e/1/npm-linux/package.json.lpm-dependency-evidence-7df6effc-6cd5-43c0-bf90-196c037e3b6e/1/npm-linux/scripts/prebuild.js.lpm-dependency-evidence-7df6effc-6cd5-43c0-bf90-196c037e3b6e/1/npm-linux/scripts/post-install.js
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package postinstall runs a helper that only adjusts execute permissions on node-pty spawn helpers; declared dependencies are node-pty, qrcode, and ws.
- Inference requests send the configured XAI key to the configured base URL; the default is api.x.ai, and the key comes from XAI_API_KEY or ~/.agentvox/xai.key.
- Enrollment sends a caller-supplied token to the --proxy URL provided to the explicit enrollment command.
- The Vox daemon collects username, hostname, and working directory as metadata and contacts the configured AgentVox proxy.
- The updater checks npm for a newer version and installs the package globally; the inspected node-pty install hooks perform native build setup, and its cleanup is scoped to its own release directory.
- The dependency manifest maps browser imports to browser.js, ES module imports to wrapper.mjs, and CommonJS imports to index.js.
- The ES module wrapper exports the WebSocket implementation and related stream, extension, receiver, sender, and server APIs.
- The browser entry throws an error directing browser clients to use the native WebSocket object.
Evidence against
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "node:path";
L14: import { spawn, spawnSync } from "node:child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j2 = await r.json();
L24: return typeof j2.version === "string" ? j2.version : null;
...
L45: var defaultReExec = () => {
L46: const label = process.env.XPC_SERVICE_NAME;
L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") {
L48: try {
L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13Findings
2 Critical6 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @agentvox/host@0.1.48.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.48 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.