@phnx-labs/agents-cli@1.22.60: Suspicious npm security report

Loading npm security reports…

@phnx-labs/agents-cli@1.22.60: Suspicious npm security report | LPM Firewall

Source & flagged code

12 flagged

package.jsonView file

Lines 30-70json

30 "CHANGELOG.md",

31 "README.md",

32 "LICENSE"

33 ],

34 "publishConfig": {

35 "provenance": true

36 },

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/phnx-labs/agi-cli.git"

40 },

41 "homepage": "https://agents-cli.sh",

42 "bugs": {

43 "url": "https://github.com/phnx-labs/agi-cli/issues"

44 },

45 "scripts": {

46 "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

47 "build:bin": "scripts/build-bin.sh",

48 "prepare": "npm run build",

49 "prepack": "cp ../README.md README.md",

50 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/index.ts",

52 "changelog": "bun scripts/gen-changelog.ts",

53 "gen:index": "bun scripts/gen-command-index.ts",

54 "verify:index": "bash scripts/verify-command-index.sh",

55 "start": "node dist/index.js",

56 "test": "node ./node_modules/vitest/vitest.mjs run",

57 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

58 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

59 "test:remote": "scripts/sandbox.sh test",

60 "verify-docs": "scripts/verify-docs.sh",

61 "test:watch": "node ./node_modules/vitest/vitest.mjs"

62 },

63 "keywords": [

64 "agents",

65 "cli",

66 "dotfiles",

67 "claude",

68 "codex",

69 "cursor",

70 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/bootstrap.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bootstrap.js: const response = await fetch(`https://unpkg.com/@phnx-labs/agents-cli@${toVersion}/CHANGELOG.md`); console.log(chalk.gray('\nFull notes: https://github.com/phnx-labs/agi-cli/blob/main/CHANGELOG.md')); fs.writeFileSync(sentinel, key); const response = await fetch(`https://registry.npmjs.org/${NPM_PACKAGE_NAME}/${versionOrTag}`, { // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and fetch('https://registry.npmjs.org/@phnx-labs/agents-cli/latest', { fs.writeFileSync(sentinel, sentinelValue);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bootstrap.jsView on unpkg

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/project-resources.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import * as fs from 'fs'; import * as path from 'path'; import { agents, agentconfigdirname, isagentharddeprecated } from './agents.js'; import { supports } from './capabilities.js'; import { buildcommandskillcontent, commandskillname, readskillsourcecommandmarker, shouldalsoinstallcommandasskill, shouldinstallcommandasskill } from './command-skills.js'; import { commandappliesto, parsecommandmetadata } from './commands.js'; import { markdowntotoml } from './convert.js'; import { safejoin } from './paths.js'; import { subagenttarget } from './subagents-registry.js'; import { parsesubagentfrontmatter } from './subagents.js'; import { syncworkflowtoversion } from './workflows.js';

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

175patternName = generic_password severity = medium line = 175 matchedText = const va...th);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/menubar/install-menubar.jsView file

17import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L71: function onDarwin() { L72: return process.platform === 'darwin'; L73: } ... L75: function installDir() { L76: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L77: } ... L121: try { L122: const parsed = JSON.parse(raw); L123: if (parsed && (parsed.source === 'release' || parsed.source === 'local'))

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/bootstrap.jsView file

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bootstrap.jsView on unpkg

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L24: const launch = getCliLaunch(args); L25: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L26: if ((res.status ?? 1) === 0) ... L49: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L50: const platform = process.platform; L51: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L53: console.log(chalk.cyan(' brew install --cask tailscale')); L54: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L55: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/daemon/daemon.jsView file

13Install-time code directly mutates a foreign AI-agent control surface: L74: const LOG_ROTATE_COUNT = 3; L75: const PLIST_NAME = 'com.phnx-labs.agents-daemon'; L76: const SYSTEMD_UNIT = 'agents-daemon.service'; ... L217: const dir = getDaemonDir(); L218: fs.mkdirSync(dir, { recursive: true }); L219: return dir; ... L299: export function writeDaemonPid(pid) { L300: fs.writeFileSync(getPidPath(), String(pid), 'utf-8'); L301: } ... L314: try { L315: fs.writeFileSync(getHeartbeatPath(), JSON.stringify(hb), 'utf-8'); L316: } Write operation from scripts/postinstall.js: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); L15: const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims'); L16: // System repo lives inside the user repo (folded in v1.21). Legacy installs at

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/daemon/daemon.jsView on unpkg · L13

8Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/lib/daemon/daemon.js L8: */ L9: import { spawn, execFileSync } from 'child_process'; L10: import * as fs from 'fs'; ... L87: * <this-instance's-own-never-loaded-path>` still tears down the OTHER job L88: * (verified directly against real launchctl with two throwaway plists L89: * sharing one label — the second job's own `unload` silently kills the ... L95: * Namespace the identifier itself whenever HOME has been redirected away L96: * from the account's real home. `os.userInfo().homedir` reads the OS/passwd L97: * record directly and ignores `$HOME` (unlike `os.homedir()`, which honors ... L321: const raw = fs.readFileSync(getHeartbeatPath(), 'utf-8'); L322: const hb = JSON.parse(raw); L323: if (!hb.lastTick || !hb

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/lib/daemon/daemon.js

dist/lib/project-resources.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 30-70json

30 "CHANGELOG.md",

31 "README.md",

32 "LICENSE"

33 ],

34 "publishConfig": {

35 "provenance": true

36 },

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/phnx-labs/agi-cli.git"

40 },

41 "homepage": "https://agents-cli.sh",

42 "bugs": {

43 "url": "https://github.com/phnx-labs/agi-cli/issues"

44 },

45 "scripts": {

47 "build:bin": "scripts/build-bin.sh",

48 "prepare": "npm run build",

49 "prepack": "cp ../README.md README.md",

50 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/index.ts",

52 "changelog": "bun scripts/gen-changelog.ts",

53 "gen:index": "bun scripts/gen-command-index.ts",

54 "verify:index": "bash scripts/verify-command-index.sh",

55 "start": "node dist/index.js",

56 "test": "node ./node_modules/vitest/vitest.mjs run",

57 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

59 "test:remote": "scripts/sandbox.sh test",

60 "verify-docs": "scripts/verify-docs.sh",

61 "test:watch": "node ./node_modules/vitest/vitest.mjs"

62 },

63 "keywords": [

64 "agents",

65 "cli",

66 "dotfiles",

67 "claude",

68 "codex",

69 "cursor",

70 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/bootstrap.jsView file

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bootstrap.jsView on unpkg

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/project-resources.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/project-resources.jsView on unpkg

dist/lib/acp/client.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/acp/client.jsView on unpkg

@phnx-labs/agents-cli@1.22.60

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code