registry / Persistence / @phnx-labs/agents-cli / 1.22.56

@phnx-labs/agents-cli@1.22.56

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a large first-party AI agents CLI; scanner malware-similarity hits are the product's own modules, not a nested self-install dropper. Global postinstall still auto-starts a KeepAlive daemon via LaunchAgent or systemd, which is unconsented first-party persistence even though it does not hijack foreign agent configs.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g @phnx-labs/agents-cli on macOS or Linux when CI and AGENTS_NO_HEAL are unset.

Impact

A KeepAlive agents daemon can start after install without a separate setup command, and shell PATH or a helper app may be changed.

Mechanism

postinstall first-party daemon and helper persistence

AI rationale

Evidence

scripts/postinstall.jsdist/lib/daemon/daemon.jsscripts/install-helper.js~/.agents~/.agents/.cache/shims~/Library/LaunchAgents~/.config/systemd/user~/.local/bin/agents~/Library/Application Support/agents-cli/Agents CLI.app

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Global postinstall starts an always-on first-party daemon on macOS and Linux unless CI or AGENTS_NO_HEAL is set.
That start path writes a user LaunchAgent plist or systemd user unit and loads or enables it.
When the agents command is missing from a login PATH, postinstall can append ~/.local/bin to bash_profile or profile without asking.
Postinstall copies a macOS Keychain helper app into Application Support.

Evidence against

package.json has no runtime self-dependency; prepare is a local TypeScript build and postinstall is the only registry install hook.
postinstall does not write Claude, Cursor, or other foreign agent configs; those shims are left to the user-run agents setup command.
Scanner high-similarity files are this product's agent registry, secrets broker, computer/ssh/ffmpeg helpers, and migrations, not a hidden dropper.
Non-global installs skip PATH edits and daemon heal and only print a setup hint.
Install scripts do not fetch a remote payload; listed hosts are product and provider APIs used by explicit CLI commands.

Behavioral surface

Source & flagged code

26 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/commands/secrets.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/secrets.jsView on unpkg

175patternName = generic_password severity = medium line = 175

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

dist/bootstrap.jsView file

387if (answer === 'now') { L388: const { spawnSync } = await import('child_process'); L389: let spinner = ora('Resolving package metadata...').start();

High

Child Process

Package source references child process execution.

dist/bootstrap.jsView on unpkg · L387

dist/lib/monitors/state.jsView file

207* anything else (nonzero, timeout, spawn error, empty command) is "no effect". L208: * Real `/bin/sh -c` (or `cmd /c`) — the same seam command sources use. L209: */

High

Shell

Package source references shell execution.

dist/lib/monitors/state.jsView on unpkg · L207

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/menubar/install-menubar.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/menubar/install-menubar.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/menubar/install-menubar.jsView on unpkg

17import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L71: function onDarwin() { L72: return process.platform === 'darwin'; L73: } ... L75: function installDir() { L76: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L77: } ... L121: try { L122: const parsed = JSON.parse(raw); L123: if (parsed && (parsed.source === 'release' || parsed.source === 'local'))

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/lib/cloud/factory.js#virtual:normalized:round1View file

11* completion with `--output-format stream-json`, buffers the NDJSON events, and L12: * `stream()` replays them. The task id is droid"s own `session_id` (captured\n * from the run output), so it lines up with `droid exec -s <id>` for future\n * resume support.\n *\n... L13: * row as the computer name and keep the remainder as a label, skipping headers, ... L50: * the Droid relay. The relay is used as an OpenSSH ProxyCommand L51: * (`droid computer ssh <name> --proxy`), so the connection rides Factory"s\n * brokered tunnel rather than a directly reachable host.\n *\n * `remoteArgv` is the already-built remo... L52: events.push({ type: "unknown", name: "stdout", data: trimmed, timestamp: new Date().toISOString() });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/lib/cloud/factory.js#virtual:normalized:round1View on unpkg · L11

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L24: const launch = getCliLaunch(args); L25: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L26: if ((res.status ?? 1) === 0) ... L49: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L50: const platform = process.platform; L51: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L53: console.log(chalk.cyan(' brew install --cask tailscale')); L54: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L55: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/daemon/daemon.jsView file

13Install-time code directly mutates a foreign AI-agent control surface: L73: const LOG_ROTATE_COUNT = 3; L74: const PLIST_NAME = 'com.phnx-labs.agents-daemon'; L75: const SYSTEMD_UNIT = 'agents-daemon.service'; ... L216: const dir = getDaemonDir(); L217: fs.mkdirSync(dir, { recursive: true }); L218: return dir; ... L298: export function writeDaemonPid(pid) { L299: fs.writeFileSync(getPidPath(), String(pid), 'utf-8'); L300: } ... L313: try { L314: fs.writeFileSync(getHeartbeatPath(), JSON.stringify(hb), 'utf-8'); L315: } Write operation from scripts/postinstall.js: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); L15: const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims'); L16: // System repo lives inside the user repo (folded in v1.21). Legacy installs at

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/daemon/daemon.jsView on unpkg · L13

dist/lib/installations/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ntentries) { if (!agent.isdirectory()) continue; const sysagentdir = path.join(sysversions, agent.name); const useragentdir = path.join(userversions, agent.name); let verentries; try { verentries = fs.readdirsync(sysagentdir, { withfiletypes: true }); } catch { continue; } for (const ver of verentries) { if (!ver.isdirectory()) continue; const syshome = path.join(sysagentdir, ver.name, 'home'); const userhome = path.join(useragentdir, ver.name, 'home'); if (!fs.existssync(syshome) || !fs.existssync(userhome))

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/installations/migrate.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

9Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js L9: import * as readline from 'readline'; L10: import { spawnSync } from 'child_process'; L11: import { fileURLToPath } from 'url'; L12: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); ... L27: function resolveAgentsBin() { L28: if (process.platform !== 'darwin') return AGENTS_JS_ENTRYPOINT; L29: try { ... L53: // can't take down the rest of postinstall. install-helper.js stays silent L54: // on no-op and emits one stdout line on success. L55: spawnSync(process.execPath, [INSTALL_HELPER_SCRIPT], { stdio: 'inherit' });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.jsView on unpkg · L9

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 35

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/commands/setup.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/commands/setup.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/agent-spec/agents.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/agent-spec/agents.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/agent-spec/agents.jsView on unpkg

dist/lib/secrets/agent.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/secrets/agent.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/secrets/agent.jsView on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.109 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.109 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/commands/computer.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/commands/computer.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/computer.jsView on unpkg

dist/lib/browser/drivers/ssh.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.109 matchedPath = dist/lib/browser/drivers/ssh.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.109 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/browser/drivers/ssh.jsView on unpkg

dist/lib/browser/ffmpeg.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.109 matchedPath = dist/lib/browser/ffmpeg.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.109 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/browser/ffmpeg.jsView on unpkg

dist/lib/exec.jsView file

•matchType = token_shingles matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/exec.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/exec.jsView on unpkg

dist/lib/installations/versions.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/installations/versions.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/installations/versions.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

2 Critical19 High7 Medium6 Low

CriticalDownload Executedist/lib/cloud/factory.js#virtual:normalized:round1

CriticalAi Agent Control Hijackdist/lib/daemon/daemon.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bootstrap.js

HighShelldist/lib/monitors/state.js

HighSandbox Evasion Gated Capabilitydist/commands/setup-fleet.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/installations/migrate.js

HighTrigger Reachable Persistencescripts/postinstall.js

HighSemantic Analysis Limiteddist/commands/computer.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/setup.js

Affected versions and remediation

This report applies to @phnx-labs/agents-cli@1.22.56.

See all versions of @phnx-labs/agents-cli for other recorded verdicts.

Review the evidence and your use of @phnx-labs/agents-cli@1.22.56 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 00:25:01.307Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code