registry / @phnx-labs/agents-cli / 1.22.47

@phnx-labs/agents-cli@1.22.47

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Automatic installation of a bundled helper and command shims creates a meaningful package-owned agent-extension lifecycle risk. The inspected code does not show unconsented foreign agent-config mutation, exfiltration, or remote payload execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install invokes the postinstall lifecycle hook.

Impact

The package gains persistent user-scoped launch points for its own CLI and helper.

Mechanism

Lifecycle-installed command shims and a macOS application bundle.

AI rationale

Evidence

scripts/postinstall.jsscripts/install-helper.jsdist/lib/secrets/Agents CLI.app~/.agents/.cache/shims/*~/Library/Application Support/agents-cli/Agents CLI.app

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package automatically runs scripts/postinstall.js after installation.
On macOS, that hook launches an installer which replaces a user-scoped Agents CLI.app bundle.
The hook also creates executable shorthand shims that redirect AI-agent commands to this package.

Evidence against

Shell startup-file modification is gated by AGENTS_INIT_SHELL or an interactive prompt.
No concrete credential exfiltration, unrelated network destination, or foreign AI-agent configuration mutation was established in the inspected lifecycle code.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 756 file(s), 10.5 MB of source, external domains: 127.0.0.1, accounts.google.com, agents-cli.sh, ai.azure.com, anthropic.com, antigravity.google, api.anthropic.com, api.cloudflare.com, api.cursor.com, api.deepinfra.com, api.example.com, api.factory.ai, api.hetzner.cloud, api.kimi.com, api.linear.app, api.meta.ai, api.openai.com, api.prix.dev, app.factory.ai, app.warp.dev, aws.amazon.com, cloud.google.com, cloudcode-pa.googleapis.com, code.kimi.com, console.anthropic.com, console.hetzner.cloud, console.x.ai, cursor.com, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, deepinfra.com, dev.meta.ai, developers.googleblog.com, docs.openclaw.ai, docs.x.ai, example.com, generativelanguage.googleapis.com, git-scm.com, github.com, gw.corp, hermes-agent.nousresearch.com, linear.app, login.tailscale.com, nodejs.org, oauth2.googleapis.com, opencode.ai, openrouter.ai, phoenix-id.muqsitnawaz.workers.dev, platform.claude.com, raw.githubusercontent.com

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bootstrap.jsView file

505if (answer === 'now') { L506: const { spawnSync } = await import('child_process'); L507: let spinner = ora('Resolving package metadata...').start();

High

Child Process

Package source references child process execution.

dist/bootstrap.jsView on unpkg · L505

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/bootstrap.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/lib/exec.jsView file

263* is what maps a launch to its exact session even when the hook runs under a L264: * different pid (tmux pane leaf / cmd.exe wrapper) — and, across an SSH hop, what L265: * lets a `--device` launcher resolve the remote-coined id for agents that never

High

Shell

Package source references shell execution.

dist/lib/exec.jsView on unpkg · L263

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/menubar/install-menubar.jsView file

17import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L55: function onDarwin() { L56: return process.platform === 'darwin'; L57: } ... L59: function installDir() { L60: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L61: } ... L214: }); L215: const out = `${r.stderr || ''}${r.stdout || ''}`; L216: const team = out.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/lib/cloud/factory.js#virtual:normalized:round1View file

11* completion with `--output-format stream-json`, buffers the NDJSON events, and L12: * `stream()` replays them. The task id is droid"s own `session_id` (captured\n * from the run output), so it lines up with `droid exec -s <id>` for future\n * resume support.\n *\n... L13: * row as the computer name and keep the remainder as a label, skipping headers, ... L50: * the Droid relay. The relay is used as an OpenSSH ProxyCommand L51: * (`droid computer ssh <name> --proxy`), so the connection rides Factory"s\n * brokered tunnel rather than a directly reachable host.\n *\n * `remoteArgv` is the already-built remo... L52: events.push({ type: "unknown", name: "stdout", data: trimmed, timestamp: new Date().toISOString() });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/lib/cloud/factory.js#virtual:normalized:round1View on unpkg · L11

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L24: const launch = getCliLaunch(args); L25: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L26: if ((res.status ?? 1) === 0) ... L49: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L50: const platform = process.platform; L51: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L53: console.log(chalk.cyan(' brew install --cask tailscale')); L54: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L55: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/daemon/daemon.jsView file

13Install-time code directly mutates a foreign AI-agent control surface: L44: const LOG_ROTATE_COUNT = 3; L45: const PLIST_NAME = 'com.phnx-labs.agents-daemon'; L46: const SYSTEMD_UNIT = 'agents-daemon.service'; ... L209: const dir = getDaemonDir(); L210: fs.mkdirSync(dir, { recursive: true }); L211: return dir; ... L291: export function writeDaemonPid(pid) { L292: fs.writeFileSync(getPidPath(), String(pid), 'utf-8'); L293: } ... L306: try { L307: fs.writeFileSync(getHeartbeatPath(), JSON.stringify(hb), 'utf-8'); L308: } Write operation from scripts/postinstall.js: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); L15: const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims'); L16: // System repo lives inside the user repo (folded in v1.21). Legacy installs at

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/daemon/daemon.jsView on unpkg · L13

dist/lib/installations/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ntentries) { if (!agent.isdirectory()) continue; const sysagentdir = path.join(sysversions, agent.name); const useragentdir = path.join(userversions, agent.name); let verentries; try { verentries = fs.readdirsync(sysagentdir, { withfiletypes: true }); } catch { continue; } for (const ver of verentries) { if (!ver.isdirectory()) continue; const syshome = path.join(sysagentdir, ver.name, 'home'); const userhome = path.join(useragentdir, ver.name, 'home'); if (!fs.existssync(syshome) || !fs.existssync(userhome))

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/installations/migrate.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

9Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js L9: import * as readline from 'readline'; L10: import { spawnSync } from 'child_process'; L11: import { fileURLToPath } from 'url'; L12: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); ... L27: function resolveAgentsBin() { L28: if (process.platform !== 'darwin') return AGENTS_JS_ENTRYPOINT; L29: try { ... L53: // can't take down the rest of postinstall. install-helper.js stays silent L54: // on no-op and emits one stdout line on success. L55: spawnSync(process.execPath, [INSTALL_HELPER_SCRIPT], { stdio: 'inherit' });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.jsView on unpkg · L9

dist/lib/menubar/MenubarHelper.app/Contents/MacOS/MenubarHelperView file

•path = dist/lib/menubar/MenubarHelper.[redacted] kind = native_binary sizeBytes = 3312384 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/lib/menubar/MenubarHelper.app/Contents/MacOS/MenubarHelperView on unpkg

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 35

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/commands/setup.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/commands/setup.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/agent-spec/agents.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/agent-spec/agents.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/agent-spec/agents.jsView on unpkg

dist/lib/cli-resources.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/cli-resources.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/cli-resources.jsView on unpkg

dist/lib/secrets/agent.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/secrets/agent.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/secrets/agent.jsView on unpkg

dist/lib/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/self-update.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/self-update.jsView on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/commands/computer.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/commands/computer.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/computer.jsView on unpkg

dist/commands/secrets.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/commands/secrets.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/secrets.jsView on unpkg

dist/lib/browser/chrome.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/browser/chrome.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/browser/chrome.jsView on unpkg

dist/lib/daemon/runner.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/daemon/runner.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/daemon/runner.jsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bootstrap.jsView file

505if (answer === 'now') { L506: const { spawnSync } = await import('child_process'); L507: let spinner = ora('Resolving package metadata...').start();

High

Child Process

Package source references child process execution.

dist/bootstrap.jsView on unpkg · L505

Findings

2 Critical19 High6 Medium6 Low

CriticalDownload Executedist/lib/cloud/factory.js#virtual:normalized:round1

CriticalAi Agent Control Hijackdist/lib/daemon/daemon.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bootstrap.js

HighShelldist/lib/exec.js

HighSandbox Evasion Gated Capabilitydist/commands/setup-fleet.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/installations/migrate.js

HighTrigger Reachable Persistencescripts/postinstall.js

HighSemantic Analysis Limiteddist/commands/computer.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/setup.js

High

Affected versions and remediation

This report applies to @phnx-labs/agents-cli@1.22.47.

See all versions of @phnx-labs/agents-cli for other recorded verdicts.

Review the evidence and your use of @phnx-labs/agents-cli@1.22.47 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 21:41:26.275Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code