@phnx-labs/agents-cli@1.22.21: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@phnx-labs/agents-cli@1.22.21: Suspicious npm security report | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js on install.
scripts/postinstall.js creates ~/.agents shims and may alter PATH files or symlinks.
On macOS postinstall copies a bundled Keychain helper and restarts an existing package daemon.
dist/lib/menubar/install-menubar.js can create a package-owned LaunchAgent with KeepAlive.

Evidence against

Shell rc mutation is interactive or explicitly gated by AGENTS_INIT_SHELL, except a scoped PATH repair.
Lifecycle changes are scoped to agents-cli paths/services, not foreign agent controls.
Usage API requests send provider credentials only to corresponding provider endpoints.
No inspected source showed hidden exfiltration, remote payload loading, or destructive behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 633 file(s), 8.35 MB of source, external domains: 127.0.0.1, accounts.google.com, ai.azure.com, anthropic.com, antigravity.google, api.anthropic.com, api.cloudflare.com, api.example.com, api.factory.ai, api.hetzner.cloud, api.kimi.com, api.linear.app, api.openai.com, api.prix.dev, app.factory.ai, aws.amazon.com, cloud.google.com, cloudcode-pa.googleapis.com, code.kimi.com, console.anthropic.com, console.hetzner.cloud, console.x.ai, cursor.com, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, developers.googleblog.com, docs.openclaw.ai, docs.x.ai, example.com, generativelanguage.googleapis.com, git-scm.com, github.com, gw.corp, hermes-agent.nousresearch.com, linear.app, login.tailscale.com, nodejs.org, oauth2.googleapis.com, opencode.ai, openrouter.ai, platform.claude.com, raw.githubusercontent.com, registry.modelcontextprotocol.io, registry.npmjs.org, secure.ssl.com, share.agents-cli.sh, static.cloudflareinsights.com, tailscale.com, www.apple.com, www.linkedin.com

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

173patternName = generic_password severity = medium line = 173 matchedText = const va...th);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L173

dist/index.jsView file

549if (answer === 'now') { L550: const { spawnSync } = await import('child_process'); L551: let spinner = ora('Resolving package metadata...').start();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L549

dist/lib/monitors/sources/command.jsView file

5* command on an interval — the evaluation is identical, so poll.ts delegates L6: * here. No agent, no sandbox: a plain `/bin/sh -c` (or `cmd /c` on Windows). L7: */

High

Shell

Package source references shell execution.

dist/lib/monitors/sources/command.jsView on unpkg · L5

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/agents.jsView file

11*/ L12: import { execFile } from 'child_process'; L13: import { promisify } from 'util'; ... L27: const execFileAsync = promisify(execFile); L28: const HOME = os.homedir(); L29: /** ... L42: try { L43: cliVersionCache = JSON.parse(fs.readFileSync(CLI_VERSION_CACHE_PATH, 'utf-8')); L44: } ... L74: export function findInPath(command) { L75: const pathEnv = process.env.PATH || ''; L76: const pathExt = process.platform === 'win32' ? (process.env.PATHEXT || '').split(';') : [''];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/agents.jsView on unpkg · L11

dist/lib/auto-dispatch-linear.jsView file

13*/ L14: import { execFileSync } from 'child_process'; L15: const LINEAR_API = 'https://api.linear.app/graphql'; L16: /** Resolve the Linear API key from env or (on macOS) the keychain. Null if absent. */ L17: export function resolveLinearApiKey() { L18: const fromEnv = process.env.LINEAR_API_KEY?.trim(); L19: if (fromEnv)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/auto-dispatch-linear.jsView on unpkg · L13

13*/ L14: import { execFileSync } from 'child_process'; L15: const LINEAR_API = 'https://api.linear.app/graphql'; L16: /** Resolve the Linear API key from env or (on macOS) the keychain. Null if absent. */ L17: export function resolveLinearApiKey() { L18: const fromEnv = process.env.LINEAR_API_KEY?.trim(); L19: if (fromEnv) L20: return fromEnv; L21: if (process.platform === 'darwin') { L22: try { ... L40: headers: { Authorization: apiKey, 'Content-Type': 'application/json' }, L41: body: JSON.stringify({ query, variables }),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib/auto-dispatch-linear.jsView on unpkg · L13

dist/lib/usage.jsView file

11*/ L12: import { execFile } from 'child_process'; L13: import { createHash } from 'crypto'; ... L28: const execFileAsync = promisify(execFile); L29: const CLAUDE_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage'; L30: const CLAUDE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token'; ... L700: } L701: const data = await response.json(); L702: const windows = normalizeClaudeWindows(data); ... L731: const rel = ['.kimi-code', 'credentials', 'kimi-code.json']; L732: const perVersion = path.join(home || os.homedir(), ...rel); L733: try {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lib/usage.jsView on unpkg · L11

dist/lib/daemon.jsView file

13Install-time code directly mutates a foreign AI-agent control surface: L33: const LOG_ROTATE_COUNT = 3; L34: const PLIST_NAME = 'com.phnx-labs.agents-daemon'; L35: const SYSTEMD_UNIT = 'agents-daemon.service'; ... L63: const dir = getDaemonDirRoot(); L64: fs.mkdirSync(dir, { recursive: true }); L65: return dir; ... L137: export function writeDaemonPid(pid) { L138: fs.writeFileSync(getPidPath(), String(pid), 'utf-8'); L139: } ... L152: try { L153: fs.writeFileSync(getHeartbeatPath(), JSON.stringify(hb), 'utf-8'); L154: } Write operation from scripts/postinstall.js: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); L15: const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims'); L16: // System repo lives inside the user repo (folded in v1.21). Legacy installs at

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/daemon.jsView on unpkg · L13

dist/lib/menubar/install-menubar.jsView file

17Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/lib/menubar/install-menubar.js L17: import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L44: function onDarwin() { L45: return process.platform === 'darwin'; L46: } ... L48: function installDir() { L49: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L50: } ... L203: }); L204: const out = `${r.stderr || ''}${r.stdout || ''}`; L205: const team = out.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1];

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 73967312 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/menubar/MenubarHelper.app/Contents/Resources/AppIcon.icnsView file

•path = dist/lib/menubar/MenubarHelper.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 80744 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/lib/menubar/MenubarHelper.app/Contents/Resources/AppIcon.icnsView on unpkg