@phnx-labs/agents-cli@1.22.42: Suspicious npm security report

Loading npm security reports…

@phnx-labs/agents-cli@1.22.42: Suspicious npm security report | LPM Firewall

Source & flagged code

14 flagged

package.jsonView file

Lines 33-73json

33 "CHANGELOG.md",

34 "README.md",

35 "LICENSE"

36 ],

37 "publishConfig": {

38 "provenance": true

39 },

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/phnx-labs/agents-cli.git"

43 },

44 "homepage": "https://agents-cli.sh",

45 "bugs": {

46 "url": "https://github.com/phnx-labs/agents-cli/issues"

47 },

48 "scripts": {

49 "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -d 'bin/Agents CLI.app' ] && cp -R 'bin/Agents CLI.app' 'dist/lib/secrets/Agents CLI.app' || true) && ([ -d 'bin/MenubarHelper.app' ] && mkdir -p 'dist/lib/menubar' && cp -R 'bin/MenubarHelper.app' 'dist/lib/menubar/MenubarHelper.app' || true) && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

50 "build:bin": "scripts/build-bin.sh",

51 "prepare": "npm run build",

52 "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",

53 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "dev": "tsx src/index.ts",

55 "changelog": "bun scripts/gen-changelog.ts",

56 "gen:index": "bun scripts/gen-command-index.ts",

57 "verify:index": "bash scripts/verify-command-index.sh",

58 "start": "node dist/index.js",

59 "test": "node ./node_modules/vitest/vitest.mjs run",

60 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

61 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

62 "test:remote": "scripts/sandbox.sh 'cd apps/cli && bun install && bun run build && bun run test'",

63 "verify-docs": "scripts/verify-docs.sh",

64 "test:watch": "node ./node_modules/vitest/vitest.mjs"

65 },

66 "keywords": [

67 "agents",

68 "cli",

69 "dotfiles",

70 "claude",

71 "codex",

72 "cursor",

73 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/bootstrap.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bootstrap.js: logs [id] Show a run's log — host-dispatch task or session; -f to follow const response = await fetch(`https://unpkg.com/@phnx-labs/agents-cli@${toVersion}/CHANGELOG.md`); console.log(chalk.gray('\nFull notes: https://github.com/phnx-labs/agents-cli/blob/main/CHANGELOG.md')); fs.writeFileSync(sentinel, key); const response = await fetch(`https://registry.npmjs.org/${NPM_PACKAGE_NAME}/${versionOrTag}`, { // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and fetch('https://registry.npmjs.org/@phnx-labs/agents-cli/lates

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bootstrap.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @phnx-labs/agents-cli@1.22.39 matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.39 similarity = 0.658 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/project-resources.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import * as fs from 'fs'; import * as path from 'path'; import { agents, agentconfigdirname, isagentharddeprecated } from './agents.js'; import { supports } from './capabilities.js'; import { buildcommandskillcontent, commandskillname, readskillsourcecommandmarker, shouldalsoinstallcommandasskill, shouldinstallcommandasskill } from './command-skills.js'; import { commandappliesto, parsecommandmetadata } from './commands.js'; import { markdowntotoml } from './convert.js'; import { safejoin } from './paths.js'; import { subagenttarget } from './subagents-registry.js'; import { parsesubagentfrontmatter } from './subagents.js'; import { syncworkflowtoversion } from './workflows.js';

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 75106640 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

175patternName = generic_password severity = medium line = 175 matchedText = const va...th);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/menubar/install-menubar.jsView file

17import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L55: function onDarwin() { L56: return process.platform === 'darwin'; L57: } ... L59: function installDir() { L60: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L61: } ... L214: }); L215: const out = `${r.stderr || ''}${r.stdout || ''}`; L216: const team = out.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/bootstrap.jsView file

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bootstrap.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L24: const launch = getCliLaunch(args); L25: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L26: if ((res.status ?? 1) === 0) ... L49: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L50: const platform = process.platform; L51: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L53: console.log(chalk.cyan(' brew install --cask tailscale')); L54: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L55: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/daemon/daemon.jsView file

13Install-time code directly mutates a foreign AI-agent control surface: L44: const LOG_ROTATE_COUNT = 3; L45: const PLIST_NAME = 'com.phnx-labs.agents-daemon'; L46: const SYSTEMD_UNIT = 'agents-daemon.service'; ... L209: const dir = getDaemonDir(); L210: fs.mkdirSync(dir, { recursive: true }); L211: return dir; ... L291: export function writeDaemonPid(pid) { L292: fs.writeFileSync(getPidPath(), String(pid), 'utf-8'); L293: } ... L306: try { L307: fs.writeFileSync(getHeartbeatPath(), JSON.stringify(hb), 'utf-8'); L308: } Write operation from scripts/postinstall.js: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); L15: const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims'); L16: // System repo lives inside the user repo (folded in v1.21). Legacy installs at

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/daemon/daemon.jsView on unpkg · L13

8Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/lib/daemon/daemon.js L8: */ L9: import { spawn, execFileSync } from 'child_process'; L10: import * as fs from 'fs'; ... L57: * <this-instance's-own-never-loaded-path>` still tears down the OTHER job L58: * (verified directly against real launchctl with two throwaway plists L59: * sharing one label — the second job's own `unload` silently kills the ... L65: * Namespace the identifier itself whenever HOME has been redirected away L66: * from the account's real home. `os.userInfo().homedir` reads the OS/passwd L67: * record directly and ignores `$HOME` (unlike `os.homedir()`, which honors ... L313: const raw = fs.readFileSync(getHeartbeatPath(), 'utf-8'); L314: const hb = JSON.parse(raw); L315: if (!hb.lastTick || !hb

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/lib/daemon/daemon.js

dist/lib/project-resources.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 75106640 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 33-73json

33 "CHANGELOG.md",

34 "README.md",

35 "LICENSE"

36 ],

37 "publishConfig": {

38 "provenance": true

39 },

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/phnx-labs/agents-cli.git"

43 },

44 "homepage": "https://agents-cli.sh",

45 "bugs": {

46 "url": "https://github.com/phnx-labs/agents-cli/issues"

47 },

48 "scripts": {

50 "build:bin": "scripts/build-bin.sh",

51 "prepare": "npm run build",

52 "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",

53 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "dev": "tsx src/index.ts",

55 "changelog": "bun scripts/gen-changelog.ts",

56 "gen:index": "bun scripts/gen-command-index.ts",

57 "verify:index": "bash scripts/verify-command-index.sh",

58 "start": "node dist/index.js",

59 "test": "node ./node_modules/vitest/vitest.mjs run",

60 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

62 "test:remote": "scripts/sandbox.sh 'cd apps/cli && bun install && bun run build && bun run test'",

63 "verify-docs": "scripts/verify-docs.sh",

64 "test:watch": "node ./node_modules/vitest/vitest.mjs"

65 },

66 "keywords": [

67 "agents",

68 "cli",

69 "dotfiles",

70 "claude",

71 "codex",

72 "cursor",

73 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/bootstrap.jsView file

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bootstrap.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/project-resources.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/bin/agentsView file

•path = dist/bin/agents kind = native_binary sizeBytes = 75106640 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/agentsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

@phnx-labs/agents-cli@1.22.42

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code