registry / @phnx-labs/agents-cli / 1.22.51

@phnx-labs/agents-cli@1.22.51

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Readable source shows a real multi-agent CLI whose postinstall starts a first-party persistent daemon and writes its own shims, while user commands can adopt foreign agent homes. Scanner malware-similarity labels look noisy against that product structure, but dist/lib/session/discover.js is unreadable binary and the dual-use install-time daemon is enough for a warn rather than a clean or block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of this package, which runs postinstall; later user commands such as agents setup, agents computer, or monitors.

Impact

A long-running local daemon and PATH or shim changes can appear without a separate setup command; later explicit commands can rewrite other agent homes and run unsandboxed host actions. An unread binary module leaves residual uncertainty.

Mechanism

first-party install-time daemon and shim setup plus dual-use agent and host control commands

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/lib/daemon/daemon.jsdist/commands/setup.jsdist/lib/session/discover.d.tsdist/lib/monitors/sources/command.jsdist/commands/computer.js~/.agents/.cache/shims~/Library/LaunchAgents~/.config/systemd/user/agents-daemon.service~/.local/bin/agents~/.claude

Network endpoints3

registry.npmjs.org/@phnx-labs/agents-cli/latestphoenix-id.muqsitnawaz.workers.dev

Decision evidence

public snapshot

AI called this Suspicious at 69.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

npm postinstall always runs scripts/postinstall.js after install.
On macOS and Linux that hook starts or restarts a persistent agents daemon, including launchd or systemd registration.
The same hook writes shims under ~/.agents and can add PATH entries or local bin links.
The user command agents setup can move existing agent homes such as ~/.claude and replace them with symlinks.
dist/lib/session/discover.js is binary or non-UTF8, so that module could not be inspected as source.
User-facing features include unsandboxed shell monitors and a computer-control helper with LaunchAgents.

Evidence against

package.json has no runtime self-dependency on @phnx-labs/agents-cli.
Readable postinstall does not write foreign agent configs such as ~/.claude; that happens only in agents setup.
Shell rc edits are TTY-prompted or gated on AGENTS_INIT_SHELL=1.
Inspected command modules match a multi-agent CLI product rather than a dropper.
No eval or Function constructors, and no reviewer-directed social engineering, were found in inspected files.
prepare is a TypeScript build, not a hidden payload.

Source & flagged code

26 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/commands/secrets.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/secrets.jsView on unpkg

175patternName = generic_password severity = medium line = 175

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

dist/bootstrap.jsView file

507if (answer === 'now') { L508: const { spawnSync } = await import('child_process'); L509: let spinner = ora('Resolving package metadata...').start();

High

Child Process

Package source references child process execution.

dist/bootstrap.jsView on unpkg · L507

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/bootstrap.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/lib/monitors/sources/command.jsView file

5* command on an interval — the evaluation is identical, so poll.ts delegates L6: * here. No agent, no sandbox: a plain `/bin/sh -c` (or `cmd /c` on Windows). L7: */

High

Shell

Package source references shell execution.

dist/lib/monitors/sources/command.jsView on unpkg · L5

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/menubar/install-menubar.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/menubar/install-menubar.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/menubar/install-menubar.jsView on unpkg

17import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L71: function onDarwin() { L72: return process.platform === 'darwin'; L73: } ... L75: function installDir() { L76: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L77: } ... L121: try { L122: const parsed = JSON.parse(raw); L123: if (parsed && (parsed.source === 'release' || parsed.source === 'local'))

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/lib/cloud/factory.js#virtual:normalized:round1View file

11* completion with `--output-format stream-json`, buffers the NDJSON events, and L12: * `stream()` replays them. The task id is droid"s own `session_id` (captured\n * from the run output), so it lines up with `droid exec -s <id>` for future\n * resume support.\n *\n... L13: * row as the computer name and keep the remainder as a label, skipping headers, ... L50: * the Droid relay. The relay is used as an OpenSSH ProxyCommand L51: * (`droid computer ssh <name> --proxy`), so the connection rides Factory"s\n * brokered tunnel rather than a directly reachable host.\n *\n * `remoteArgv` is the already-built remo... L52: events.push({ type: "unknown", name: "stdout", data: trimmed, timestamp: new Date().toISOString() });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/lib/cloud/factory.js#virtual:normalized:round1View on unpkg · L11

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L24: const launch = getCliLaunch(args); L25: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L26: if ((res.status ?? 1) === 0) ... L49: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L50: const platform = process.platform; L51: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L53: console.log(chalk.cyan(' brew install --cask tailscale')); L54: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L55: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/daemon/daemon.jsView file

13Install-time code directly mutates a foreign AI-agent control surface: L70: const LOG_ROTATE_COUNT = 3; L71: const PLIST_NAME = 'com.phnx-labs.agents-daemon'; L72: const SYSTEMD_UNIT = 'agents-daemon.service'; ... L221: const dir = getDaemonDir(); L222: fs.mkdirSync(dir, { recursive: true }); L223: return dir; ... L303: export function writeDaemonPid(pid) { L304: fs.writeFileSync(getPidPath(), String(pid), 'utf-8'); L305: } ... L318: try { L319: fs.writeFileSync(getHeartbeatPath(), JSON.stringify(hb), 'utf-8'); L320: } Write operation from scripts/postinstall.js: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); L15: const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims'); L16: // System repo lives inside the user repo (folded in v1.21). Legacy installs at

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/daemon/daemon.jsView on unpkg · L13

dist/lib/installations/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ntentries) { if (!agent.isdirectory()) continue; const sysagentdir = path.join(sysversions, agent.name); const useragentdir = path.join(userversions, agent.name); let verentries; try { verentries = fs.readdirsync(sysagentdir, { withfiletypes: true }); } catch { continue; } for (const ver of verentries) { if (!ver.isdirectory()) continue; const syshome = path.join(sysagentdir, ver.name, 'home'); const userhome = path.join(useragentdir, ver.name, 'home'); if (!fs.existssync(syshome) || !fs.existssync(userhome))

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

9Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js L9: import * as readline from 'readline'; L10: import { spawnSync } from 'child_process'; L11: import { fileURLToPath } from 'url'; L12: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); ... L27: function resolveAgentsBin() { L28: if (process.platform !== 'darwin') return AGENTS_JS_ENTRYPOINT; L29: try { ... L53: // can't take down the rest of postinstall. install-helper.js stays silent L54: // on no-op and emits one stdout line on success. L55: spawnSync(process.execPath, [INSTALL_HELPER_SCRIPT], { stdio: 'inherit' });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.jsView on unpkg · L9

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 34

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/commands/setup.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/commands/setup.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/accounting/usage.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/accounting/usage.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/accounting/usage.jsView on unpkg

dist/lib/agent-spec/agents.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/agent-spec/agents.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/agent-spec/agents.jsView on unpkg

dist/lib/cli-resources.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/cli-resources.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/cli-resources.jsView on unpkg

dist/lib/secrets/agent.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/secrets/agent.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/secrets/agent.jsView on unpkg

dist/lib/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/self-update.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/self-update.jsView on unpkg

dist/lib/session/discover.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/session/discover.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/session/discover.jsView on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/commands/computer.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/commands/computer.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/computer.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

2 Critical19 High7 Medium6 Low

CriticalDownload Executedist/lib/cloud/factory.js#virtual:normalized:round1

CriticalAi Agent Control Hijackdist/lib/daemon/daemon.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bootstrap.js

HighShelldist/lib/monitors/sources/command.js

HighSandbox Evasion Gated Capabilitydist/commands/setup-fleet.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/installations/migrate.js

HighTrigger Reachable Persistencescripts/postinstall.js

HighSemantic Analysis Limiteddist/commands/computer.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/setup.js

Affected versions and remediation

This report applies to @phnx-labs/agents-cli@1.22.51.

See all versions of @phnx-labs/agents-cli for other recorded verdicts.

Review the evidence and your use of @phnx-labs/agents-cli@1.22.51 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 12:29:04.130Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

@phnx-labs/agents-cli@1.22.51

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code