@agentvox/host@0.1.8

AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The postinstall script only marks node-pty spawn-helper executable. Remote commands, host metadata, and npm self-update are the documented AgentVox daemon after explicit pair or enroll, not a supply-chain implant.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs the pty helper; remote control requires running agentvox-host or agentvox-vox.

Impact

No unconsented install-time attack is present; runtime machine control is the consented product.

Mechanism

User-invoked voice host daemon with documented pairing and self-update

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

postinstall runs scripts/fix-pty-helper.mjs on install.
The vox binary can run npm i -g @agentvox/host and re-exec agentvox-vox.
After enroll, the daemon sends local user, hostname, and working directory to the paired proxy.
Base64 protocol payloads are decoded and used for tools such as host.run.
child_process is used for npm self-update and for spawning the vox process.

Evidence against

postinstall only chmod +x on node-pty spawn-helper under node_modules; it does not write agent configs or fetch payloads.
There is no eval, Function, vm, or dynamic import of remote code; decode is JSON/base64 for the voice-host protocol.
Network hosts are the product proxy, npm registry, and api.x.ai; README documents pairing and auto-update.
Remote command execution and metadata require the user to run the CLI and pair or enroll.
No package.json self-dependency, obfuscation, or reviewer-directed text.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/fix-pty-helper.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/vox.jsView file

21var resolvePipelineKind = (config) => { L22: const env = process.env.AGENTVOX_VOX_PIPELINE?.toLowerCase(); L23: const raw = env ?? config.pipeline ?? "cascaded"; ... L25: }; L26: var defaultConfigPath = () => process.env.AGENTVOX_VOX_CONFIG ?? join(homedir(), ".agentvox", "vox.json"); L27: var loadConfig = (path = defaultConfigPath()) => { L28: if (!existsSync(path)) return null; L29: const raw = JSON.parse(readFileSync(path, "utf8")); L30: return { ... L45: // ../vox/src/client.ts L46: import { WebSocket } from "ws"; L47: var noopLog = () => {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/vox.jsView on unpkg · L21

•Trigger-reachable chain: manifest.bin -> dist/vox.js Reachable file contains a blocking source-risk pattern.

Findings

2 Critical5 High5 Medium5 Low

CriticalRemote Asset Decode Executedist/vox.js

CriticalTrigger Reachable Dangerous Capabilitydist/vox.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/vox.js

HighShell

HighHost Fingerprint Exfiltrationdist/vox.js

HighRuntime Package Installdist/vox.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-systemd.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @agentvox/host@0.1.8.

See all versions of @agentvox/host for other recorded verdicts.

Review the evidence and your use of @agentvox/host@0.1.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 14:14:52.529Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.