@phnx-labs/agents-cli@1.22.39: Suspicious npm security report

Loading npm security reports…

@phnx-labs/agents-cli@1.22.39: Suspicious npm security report | LPM Firewall

Source & flagged code

17 flagged

package.jsonView file

Lines 32-72json

32 "CHANGELOG.md",

33 "README.md",

34 "LICENSE"

35 ],

36 "publishConfig": {

37 "provenance": true

38 },

39 "repository": {

40 "type": "git",

41 "url": "git+https://github.com/phnx-labs/agents-cli.git"

42 },

43 "homepage": "https://agents-cli.sh",

44 "bugs": {

45 "url": "https://github.com/phnx-labs/agents-cli/issues"

46 },

47 "scripts": {

48 "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -d 'bin/Agents CLI.app' ] && cp -R 'bin/Agents CLI.app' 'dist/lib/secrets/Agents CLI.app' || true) && ([ -d 'bin/MenubarHelper.app' ] && mkdir -p 'dist/lib/menubar' && cp -R 'bin/MenubarHelper.app' 'dist/lib/menubar/MenubarHelper.app' || true) && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

49 "build:bin": "scripts/build-bin.sh",

50 "prepare": "npm run build",

51 "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",

52 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 "dev": "tsx src/index.ts",

54 "changelog": "bun scripts/gen-changelog.ts",

55 "gen:index": "bun scripts/gen-command-index.ts",

56 "verify:index": "bash scripts/verify-command-index.sh",

57 "start": "node dist/index.js",

58 "test": "node ./node_modules/vitest/vitest.mjs run",

59 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

60 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

61 "test:remote": "scripts/sandbox.sh 'cd apps/cli && bun install && bun run build && bun run test'",

62 "verify-docs": "scripts/verify-docs.sh",

63 "test:watch": "node ./node_modules/vitest/vitest.mjs"

64 },

65 "keywords": [

66 "agents",

67 "cli",

68 "dotfiles",

69 "claude",

70 "codex",

71 "cursor",

72 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/bootstrap.jsView file

Lines 477-517javascript

477async function promptUpgrade(latestVersion) {

478 const { default: ora } = await import('ora');

479 const {

dist/lib/monitors/sources/command.jsView file

Lines 1-25javascript

1/**

2 * Command / poll source evaluator.

3 *

4 * Runs a shell command; its stdout is the observation. `poll` re-runs the same

5 * command on an interval — the evaluation is identical, so poll.ts delegates

6 * here. No agent, no sandbox: a plain `/bin/sh -c` (or `cmd /c` on Windows).

7 */

High

Shell

Package source references shell execution.

dist/lib/monitors/sources/command.jsView on unpkg · L5

8import { execFile }

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/lib/self-update.js#virtual:normalized:round1View file

213* L214: * npm"s global layout for a scoped package:\n * POSIX: <prefix>/lib/node_modules/@phnx-labs/agents-cli\n * Windows: <prefix>/node_modules/@phnx-labs/agents-cli\n *\n * Throws... L215: * `<bunGlobalDir>/node_modules/<pkg>`, which is exactly the running package ... L219: * package"s postinstall hook.\n */\nexport async function installPackageWithBun(spec) {\n const { execFile } = await import("child_process");\n const { promisify } = await im... L220: * string of the form `sha512-<base64>` — npm"s `dist.integrity`. Recomputes the\n * digest over the actual bytes with the named algorithm and compares it, in\n * constant time, to ... L221: * bare-command aliases (secrets, sessions, ...) pick up the new entrypoint ... L227: spawnSync(process.execPath, [path.join(packag

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/self-update.js#virtual:normalized:round1View on unpkg · L213

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L23: const launch = getCliLaunch(args); L24: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L25: if ((res.status ?? 1) === 0) ... L48: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L49: const platform = process.platform; L50: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L52: console.log(chalk.cyan(' brew install --cask tailscale')); L53: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L54: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/state.jsView file

3Install-time code directly mutates a foreign AI-agent control surface: L3: * L4: * Single root at ~/.agents/ with three internal buckets: L5: * L6: * ~/.agents/ — user repo: user-authored resources + agents.yaml L7: * (git-tracked via `agents repo push`). L8: * ~/.agents/.system/ — system repo: npm-shipped resources, regenerable. L9: * Don't hand-edit; maintained by npm install / L10: * `agents repo pull system`. L11: * ~/.agents/.history/ — durable runtime data (sessions, versions, runs, L12: * teams/agents, trash, backups). Backed up by L13: * `agents repo push`. L14: * ~/.agents/.cache/ — regenerable runtime data (shims, packages, helpers W

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/state.jsView on unpkg · L3

dist/lib/project-resources.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import * as fs from 'fs'; import * as path from 'path'; import { agents, agentconfigdirname, isagentharddeprecated } from './agents.js'; import { supports } from './capabilities.js'; import { buildcommandskillcontent, commandskillname, readskillsourcecommandmarker, shouldalsoinstallcommandasskill, shouldinstallcommandasskill } from './command-skills.js'; import { commandappliesto, parsecommandmetadata } from './commands.js'; import { markdowntotoml } from './convert.js'; import { safejoin } from './paths.js'; import { subagenttarget } from './subagents-registry.js'; import { parsesubagentfrontmatter } from './subagents.js'; import { syncworkflowtoversion } from './workflows.js';

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/lib/daemon.jsView file

8Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/lib/daemon.js L8: */ L9: import { spawn, execFileSync } from 'child_process'; L10: import * as fs from 'fs'; ... L223: function getLaunchdPlistPath() { L224: return path.join(os.homedir(), 'Library', 'LaunchAgents', `${PLIST_NAME}.plist`); L225: } ... L265: const raw = fs.readFileSync(getHeartbeatPath(), 'utf-8'); L266: const hb = JSON.parse(raw); L267: if (!hb.lastTick || !hb.pid) ... L411: function evictIncumbentDaemon(pid) { L412: if (process.platform === 'win32') { L413: // No graceful termination signal on Windows — take the incumbent down and

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/lib/daemon.jsView on unpkg · L8

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 74875472 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

dist/lib/exec.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @phnx-labs/agents-cli@1.22.38 matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.38 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/exec.jsView on unpkg

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

175patternName = generic_password severity = medium line = 175 matchedText = const va...th);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

dist/bootstrap.jsView file

497if (answer === 'now') { L498: const { spawnSync } = await import('child_process'); L499: let spinner = ora('Resolving package metadata...').start();

High

Child Process

Package source references child process execution.

dist/bootstrap.jsView on unpkg · L497

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bootstrap.js: logs [id] Show a run's log — host-dispatch task or session; -f to follow const response = await fetch(`https://unpkg.com/@phnx-labs/agents-cli@${toVersion}/CHANGELOG.md`); console.log(chalk.gray('\nFull notes: https://github.com/phnx-labs/agents-cli/blob/main/CHANGELOG.md')); fs.writeFileSync(sentinel, key); const response = await fetch(`https://registry.npmjs.org/${NPM_PACKAGE_NAME}/${versionOrTag}`, { // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and fetch('https://registry.npmjs.org/@phnx-labs/agents-cli/lates

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bootstrap.jsView on unpkg

dist/lib/monitors/sources/command.jsView file

5* command on an interval — the evaluation is identical, so poll.ts delegates L6: * here. No agent, no sandbox: a plain `/bin/sh -c` (or `cmd /c` on Windows). L7: */

High

Shell

Package source references shell execution.

dist/lib/monitors/sources/command.jsView on unpkg · L5

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/menubar/install-menubar.jsView file

17import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L45: function onDarwin() { L46: return process.platform === 'darwin'; L47: } ... L49: function installDir() { L50: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L51: } ... L204: }); L205: const out = `${r.stderr || ''}${r.stdout || ''}`; L206: const team = out.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/lib/self-update.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/self-update.js#virtual:normalized:round1View on unpkg · L213

dist/commands/setup-fleet.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/state.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/state.jsView on unpkg · L3

dist/lib/project-resources.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/lib/daemon.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/lib/daemon.jsView on unpkg · L8

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 74875472 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

dist/lib/exec.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/exec.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 32-72json

32 "CHANGELOG.md",

33 "README.md",

34 "LICENSE"

35 ],

36 "publishConfig": {

37 "provenance": true

38 },

39 "repository": {

40 "type": "git",

41 "url": "git+https://github.com/phnx-labs/agents-cli.git"

42 },

43 "homepage": "https://agents-cli.sh",

44 "bugs": {

45 "url": "https://github.com/phnx-labs/agents-cli/issues"

46 },

47 "scripts": {

49 "build:bin": "scripts/build-bin.sh",

50 "prepare": "npm run build",

51 "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",

52 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 "dev": "tsx src/index.ts",

54 "changelog": "bun scripts/gen-changelog.ts",

55 "gen:index": "bun scripts/gen-command-index.ts",

56 "verify:index": "bash scripts/verify-command-index.sh",

57 "start": "node dist/index.js",

58 "test": "node ./node_modules/vitest/vitest.mjs run",

59 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

61 "test:remote": "scripts/sandbox.sh 'cd apps/cli && bun install && bun run build && bun run test'",

62 "verify-docs": "scripts/verify-docs.sh",

63 "test:watch": "node ./node_modules/vitest/vitest.mjs"

64 },

65 "keywords": [

66 "agents",

67 "cli",

68 "dotfiles",

69 "claude",

70 "codex",

71 "cursor",

72 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/bootstrap.jsView file

Lines 477-517javascript

477async function promptUpgrade(latestVersion) {

478 const { default: ora } = await import('ora');

479 const {

dist/lib/monitors/sources/command.jsView file

Lines 1-25javascript

1/**

2 * Command / poll source evaluator.

3 *

4 * Runs a shell command; its stdout is the observation. `poll` re-runs the same

5 * command on an interval — the evaluation is identical, so poll.ts delegates

6 * here. No agent, no sandbox: a plain `/bin/sh -c` (or `cmd /c` on Windows).

7 */

High

Shell

Package source references shell execution.

dist/lib/monitors/sources/command.jsView on unpkg · L5

8import { execFile }

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/lib/self-update.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/self-update.js#virtual:normalized:round1View on unpkg · L213

dist/commands/setup-fleet.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/state.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/state.jsView on unpkg · L3

dist/lib/project-resources.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/lib/daemon.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/lib/daemon.jsView on unpkg · L8

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 74875472 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

dist/lib/exec.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/exec.jsView on unpkg

@phnx-labs/agents-cli@1.22.39

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code