registry / @livx.cc/agentx / 0.99.43

@livx.cc/agentx@0.99.43

Edge-native AI agent runtime — drives a virtual filesystem via any LLM (ai.libx.js). Same bytes run in node, browser, or edge.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source inspection found a feature-rich agent runtime, not an automatic install-time attack. The lifecycle hook is prepare-only and no source establishes credential redirection, stealth persistence, or a self-dependency chain.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit user invocation of the CLI or its agent tools.

Impact

The package can perform the user-authorized actions requested through those features.

Mechanism

Agent runtime features for shell execution, web search, and optional scheduling.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The prepare script changes the Git hooks path, but it is a VCS-only hook setup rather than a registry install hook.
The exported shell tool can run caller-supplied commands, although it removes common secret variables from child environments by default.
The CLI contains an explicit scheduler that can create user-level scheduled jobs when invoked.

Evidence against

There are no preinstall, install, or postinstall scripts.
The manifest has no runtime dependency on this package itself.
No source path sends credentials to an unofficial fixed gateway.
Network requests are user-invoked web-search features using configured provider keys.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscation

Source & flagged code

7 flagged

dist/index.jsView file

Lines 5337-5377javascript

5337 ["setImmediate", /\bsetImmediate\b/],

5338 ["Atomics", /\bAtomics\b/],

5339 ["SharedArrayBuffer", /\bSharedArrayBuffer\b/],

5340 ["WebAssembly", /\bWebAssembly\b/],

5341 ["Reflect", /\bReflect\b/],

5342 ["Proxy", /\bProxy\b/],

5343 ["Buffer", /\bBuffer\b/],

5344 ["while(true)", /while\s*$\s*true\s*$/],

5345 ["for(;;)", /for\s*$\s*;\s*;\s*$/],

5346 // escape sequences can smuggle a denied identifier past the substring check

5347 // (e.g. `process` parses as `process`), so forbid them outright.

5348 ["\\u escape", /\\u/],

5349 ["\\x escape", /\\x/]

5350 ];

5351 const violations = DENY.filter(([, re]) => re.test(code)).map(([name]) => name);

5352 return { ok: violations.length === 0, violations };

5353}

5354function compileSynthesizedTool(spec) {

5355 const v = validateToolCode(spec.code);

5356 if (!v.ok) throw new Error(`unsafe synthesized tool '${spec.name}': blocked tokens [${v.violations.join(", ")}]`);

5357 if (!/^[A-Za-z_]\w{0,39}$/.test(spec.name)) throw new Error(`invalid tool name '${spec.name}'`);

5358 const fn = new Function("args", "ctx", `"use strict"; return (async (args, ctx) => { ${spec.code} })(args, ctx);`);

5359 return {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L5357

5360 name: spec.name,

5361 description: spec.description,

5362 parameters: spec.parameters ?? { type: "object", properties: {} },

5363 async run(args, ctx) {

5364 const r = await fn(args, ctx);

5365 return typeof r === "string" ? r : JSON.stringify(r ?? "");

5366 }

5367 };

5368}

5369

5370// src/FakeAIClient.ts

5371var FakeAIClient = class {

5372 seen = [];

5373 script;

5374 constructor(script) {

5375 this.script = [...script];

5376 }

5377 async chat(options) {

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: await ctx.fs.writeFile(path, body); await ctx.fs.writeFile(path, current); await ctx.fs.writeFile(p, content); headers: { authorization: `Bearer ${opts.key}`, "content-type": "application/json" }, async writeFile(path, content) { for (const [p, c] of this.st.writes) await this.base.writeFile(p, c); await ctx.fs.writeFile(path, next); return join2(repoRoot, ".claude", "worktrees");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

35Trigger-reachable persistence chain: manifest.bin -> dist/cli.js L35: if (content == null || typeof content === "string") return false; L36: return content.some((p) => p.type === "image_url" && (p.image_url?.url ?? "").startsWith("data:")); L37: } ... L156: try { L157: return parseImageRef(JSON.parse(content).imageRef); L158: } catch (e) { ... L301: CONFIG_FILE_RE = /(^|\/)\.(agent|claude)\/(settings(\.[\w-]+)?\.json|config\.(json|js|mjs|cjs|ts))$/i; L302: SECRET_PAIR = /((?:^|[\s,{[])(?:export\s+)?["']?[\w.\-]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|PRIVATE_KEY|ACCESS_?KEY|AUTH(?:_?TOKEN)?|BEARER)[\w.\-]*["']?\s*[:=]\s*)(["']... L303: SECRET_TOKEN = /\b(sk-ant-[\w-]{12,}|sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|github_pat_[\w]{20,}|xox[baprs]-[\w-]{10,}|AKIA[0-

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L35

857try { L858: _dnsLookup = (await import("dns/promises")).lookup; L859: } catch {

package.jsonView file

Lines 43-83json

43 "runtime",

44 "tools",

45 "mcp",

46 "claude",

47 "sandbox"

48 ],

49 "engines": {

dist/tools.shell.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @livx.cc/agentx@0.99.42 matchedIdentity = npm:QGxpdnguY2MvYWdlbnR4:0.99.42 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools.shell.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/index.jsView file

5357if (!/^[A-Za-z_]\w{0,39}$/.test(spec.name)) throw new Error(`invalid tool name '${spec.name}'`); L5358: const fn = new Function("args", "ctx", `"use strict"; return (async (args, ctx) => { ${spec.code} })(args, ctx);`); L5359: return {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L5357

dist/cli.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

Findings

3 High7 Medium6 Low

HighCredential Redirect Persistencedist/cli.js

HighTrigger Reachable Persistencedist/cli.js

HighPrevious Version Dangerous Deltadist/tools.shell.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @livx.cc/agentx@0.99.43.

See all versions of @livx.cc/agentx for other recorded verdicts.

Review the evidence and your use of @livx.cc/agentx@0.99.43 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 06:04:26.714Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.