@phnx-labs/agents-cli@1.22.33: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@phnx-labs/agents-cli@1.22.33: Suspicious npm security report | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js at install.
scripts/postinstall.js writes ~/.agents/.cache/shims and may add ~/.local/bin to ~/.bash_profile or ~/.profile without a prompt.
On macOS postinstall copies a bundled Keychain app and can stop/restart its existing daemon/broker.
dist/index.js auto-installs a signed menu-bar LaunchAgent on macOS during normal CLI startup.

Evidence against

Shell-rc mutation via AGENTS_INIT_SHELL is explicitly opt-in; interactive PATH addition asks first.
LaunchAgent and daemon paths are first-party agents-cli components with a user disable sentinel.
No source evidence of credential harvesting or exfiltration was found in inspected lifecycle files.
Runtime update traffic is limited to package-aligned npm registry and unpkg endpoints.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 682 file(s), 9.16 MB of source, external domains: 127.0.0.1, accounts.google.com, ai.azure.com, anthropic.com, antigravity.google, api.anthropic.com, api.cloudflare.com, api.cursor.com, api.example.com, api.factory.ai, api.hetzner.cloud, api.kimi.com, api.linear.app, api.meta.ai, api.openai.com, api.prix.dev, app.factory.ai, aws.amazon.com, cloud.google.com, cloudcode-pa.googleapis.com, code.kimi.com, console.anthropic.com, console.hetzner.cloud, console.x.ai, cursor.com, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, dev.meta.ai, developers.googleblog.com, docs.openclaw.ai, docs.x.ai, example.com, generativelanguage.googleapis.com, git-scm.com, github.com, gw.corp, hermes-agent.nousresearch.com, linear.app, login.tailscale.com, nodejs.org, oauth2.googleapis.com, opencode.ai, openrouter.ai, platform.claude.com, raw.githubusercontent.com, registry.modelcontextprotocol.io, registry.npmjs.org, secure.ssl.com, share.agents-cli.sh, static.cloudflareinsights.com

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

175patternName = generic_password severity = medium line = 175 matchedText = const va...th);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

dist/index.jsView file

563if (answer === 'now') { L564: const { spawnSync } = await import('child_process'); L565: let spinner = ora('Resolving package metadata...').start();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L563

dist/lib/monitors/sources/command.jsView file

5* command on an interval — the evaluation is identical, so poll.ts delegates L6: * here. No agent, no sandbox: a plain `/bin/sh -c` (or `cmd /c` on Windows). L7: */

High

Shell

Package source references shell execution.

dist/lib/monitors/sources/command.jsView on unpkg · L5

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/agents.jsView file

11*/ L12: import { execFile } from 'child_process'; L13: import { promisify } from 'util'; ... L27: const execFileAsync = promisify(execFile); L28: const HOME = os.homedir(); L29: /** ... L42: try { L43: cliVersionCache = JSON.parse(fs.readFileSync(CLI_VERSION_CACHE_PATH, 'utf-8')); L44: } ... L111: export function findInPath(command, options = {}) { L112: const pathEnv = process.env.PATH || ''; L113: const pathExt = process.platform === 'win32' ? (process.env.PATHEXT || '').split(';') : [''];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/agents.jsView on unpkg · L11

dist/lib/auto-dispatch-linear.jsView file

13*/ L14: import { execFileSync } from 'child_process'; L15: const LINEAR_API = 'https://api.linear.app/graphql'; L16: /** Resolve the Linear API key from env or (on macOS) the keychain. Null if absent. */ L17: export function resolveLinearApiKey() { L18: const fromEnv = process.env.LINEAR_API_KEY?.trim(); L19: if (fromEnv)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/auto-dispatch-linear.jsView on unpkg · L13

13*/ L14: import { execFileSync } from 'child_process'; L15: const LINEAR_API = 'https://api.linear.app/graphql'; L16: /** Resolve the Linear API key from env or (on macOS) the keychain. Null if absent. */ L17: export function resolveLinearApiKey() { L18: const fromEnv = process.env.LINEAR_API_KEY?.trim(); L19: if (fromEnv) L20: return fromEnv; L21: if (process.platform === 'darwin') { L22: try { ... L40: headers: { Authorization: apiKey, 'Content-Type': 'application/json' }, L41: body: JSON.stringify({ query, variables }),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib/auto-dispatch-linear.jsView on unpkg · L13

dist/lib/state.jsView file

3Install-time code directly mutates a foreign AI-agent control surface: L3: * L4: * Single root at ~/.agents/ with three internal buckets: L5: * L6: * ~/.agents/ — user repo: user-authored resources + agents.yaml L7: * (git-tracked via `agents repo push`). L8: * ~/.agents/.system/ — system repo: npm-shipped resources, regenerable. L9: * Don't hand-edit; maintained by npm install / L10: * `agents repo pull system`. L11: * ~/.agents/.history/ — durable runtime data (sessions, versions, runs, L12: * teams/agents, trash, backups). Backed up by L13: * `agents repo push`. L14: * ~/.agents/.cache/ — regenerable runtime data (shims, packages, helpers W

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/state.jsView on unpkg · L3

dist/lib/menubar/install-menubar.jsView file

17Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/lib/menubar/install-menubar.js L17: import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L45: function onDarwin() { L46: return process.platform === 'darwin'; L47: } ... L49: function installDir() { L50: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L51: } ... L204: }); L205: const out = `${r.stderr || ''}${r.stdout || ''}`; L206: const team = out.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1];

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 74528720 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/menubar/MenubarHelper.app/Contents/Resources/AppIcon.icnsView file

•path = dist/lib/menubar/MenubarHelper.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 80744 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/lib/menubar/MenubarHelper.app/Contents/Resources/AppIcon.icnsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg