@phnx-labs/agents-cli@1.22.65: Suspicious npm security report

Loading npm security reports…

@phnx-labs/agents-cli@1.22.65: Suspicious npm security report | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs scripts/postinstall.js automatically after installation.
The postinstall script can add ~/.local/bin to a login-shell PATH file without a prompt when the command is unresolved.
The postinstall script starts or restarts an always-on daemon.
The daemon writes and enables a per-user systemd service or loads a launchd service.
On macOS, postinstall copies a bundled Keychain helper into the user Application Support directory.

Evidence against

package.json has no runtime dependency on @phnx-labs/agents-cli itself.
No credential exfiltration or install-time network request was found in the inspected lifecycle code.
The observed persistence is package-owned and uses named agents-cli paths rather than modifying AI-agent configuration broadly.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 827 file(s), 11.4 MB of source, external domains: 127.0.0.1, accounts.google.com, agents-cli.sh, ai.azure.com, anthropic.com, antigravity.google, api.anthropic.com, api.cloudflare.com, api.cursor.com, api.deepinfra.com, api.example.com, api.factory.ai, api.hetzner.cloud, api.kimi.com, api.linear.app, api.meta.ai, api.openai.com, api.prix.dev, app.factory.ai, app.warp.dev, aws.amazon.com, cloud.google.com, cloudcode-pa.googleapis.com, code.kimi.com, console.anthropic.com, console.hetzner.cloud, console.x.ai, cursor.com, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, deepinfra.com, dev.meta.ai, developers.googleblog.com, docs.openclaw.ai, docs.x.ai, example.com, generativelanguage.googleapis.com, git-scm.com, github.com, gw.corp, hermes-agent.nousresearch.com, id.byphoenix.com, linear.app, login.tailscale.com, nodejs.org, oauth2.googleapis.com, opencode.ai, openrouter.ai, platform.claude.com, raw.githubusercontent.com

Source & flagged code

23 flagged

package.jsonView file

Lines 30-70json

30 "CHANGELOG.md",

31 "README.md",

32 "LICENSE"

33 ],

34 "publishConfig": {

35 "provenance": true

36 },

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/phnx-labs/agi-cli.git"

40 },

41 "homepage": "https://agents-cli.sh",

42 "bugs": {

43 "url": "https://github.com/phnx-labs/agi-cli/issues"

44 },

45 "scripts": {

46 "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

47 "build:bin": "scripts/build-bin.sh",

48 "prepare": "npm run build",

49 "prepack": "cp ../README.md README.md",

50 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/index.ts",

52 "changelog": "bun scripts/gen-changelog.ts",

53 "gen:index": "bun scripts/gen-command-index.ts",

54 "verify:index": "bash scripts/verify-command-index.sh",

55 "start": "node dist/index.js",

56 "test": "node ./node_modules/vitest/vitest.mjs run",

57 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

58 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

59 "test:remote": "scripts/sandbox.sh test",

60 "verify-docs": "scripts/verify-docs.sh",

61 "test:watch": "node ./node_modules/vitest/vitest.mjs"

62 },

63 "keywords": [

64 "agents",

65 "cli",

66 "dotfiles",

67 "claude",

68 "codex",

69 "cursor",

70 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/installations/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function migraterunsintoroutines() { const src = path.join(user_dir, 'runs'); const dest = path.join(user_dir, 'routines', 'runs'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.mkdirsync(path.dirname(dest), { recursive: true, mode: 0o700 }); fs.renamesync(src, dest); } catch { } } function migratetrashtohidden() { const src = path.join(user_dir, 'trash'); const dest = path.join(user_dir, '.trash'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.renamesync(src, dest); } catch {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

9Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js L9: import * as readline from 'readline'; L10: import { spawnSync } from 'child_process'; L11: import { fileURLToPath } from 'url'; L12: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); ... L27: function resolveAgentsBin() { L28: if (process.platform !== 'darwin') return AGENTS_JS_ENTRYPOINT; L29: try { ... L53: // can't take down the rest of postinstall. install-helper.js stays silent L54: // on no-op and emits one stdout line on success. L55: spawnSync(process.execPath, [INSTALL_HELPER_SCRIPT], { stdio: 'inherit' });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.jsView on unpkg · L9

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 43

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/bootstrap.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/commands/setup.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/commands/setup.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/agent-spec/agents.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/agent-spec/agents.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/agent-spec/agents.jsView on unpkg

dist/lib/models.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/models.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/models.jsView on unpkg

dist/lib/secrets/agent.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/secrets/agent.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/secrets/agent.jsView on unpkg

dist/lib/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/self-update.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/self-update.jsView on unpkg

dist/lib/session/discover.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/session/discover.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/session/discover.jsView on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/commands/computer.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/commands/computer.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/computer.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/commands/secrets.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/secrets.jsView on unpkg

175patternName = generic_password severity = medium line = 175

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

dist/lib/sqlite.jsView file

15const isBun = typeof globalThis.Bun !== 'undefined'; L16: const require = createRequire(import.meta.url); L17: // node:sqlite emits a process-level ExperimentalWarning the first time it loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L15

dist/lib/platform/ipc.jsView file

12* touching disk, and never probe the result with fs.existsSync (it always reports L13: * false). Both forms are accepted by net.createServer / net.createConnection. L14: */ L15: export function ipcEndpoint(socketPath, platform = process.platform) { L16: if (platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/platform/ipc.jsView on unpkg · L12

dist/lib/menubar/install-menubar.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/menubar/install-menubar.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/menubar/install-menubar.jsView on unpkg

17import { fileURLToPath } from 'url'; L18: import { execFileSync, spawnSync } from 'child_process'; L19: import * as fs from 'fs'; ... L71: function onDarwin() { L72: return process.platform === 'darwin'; L73: } ... L75: function installDir() { L76: return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME); L77: } ... L121: try { L122: const parsed = JSON.parse(raw); L123: if (parsed && (parsed.source === 'release' || parsed.source === 'local'))

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/menubar/install-menubar.jsView on unpkg · L17

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L24: const launch = getCliLaunch(args); L25: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L26: if ((res.status ?? 1) === 0) ... L49: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L50: const platform = process.platform; L51: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L53: console.log(chalk.cyan(' brew install --cask tailscale')); L54: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L55: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/daemon/daemon.jsView file

13Install-time code directly mutates a foreign AI-agent control surface: L74: const LOG_ROTATE_COUNT = 3; L75: const PLIST_NAME = 'com.phnx-labs.agents-daemon'; L76: const SYSTEMD_UNIT = 'agents-daemon.service'; ... L217: const dir = getDaemonDir(); L218: fs.mkdirSync(dir, { recursive: true }); L219: return dir; ... L299: export function writeDaemonPid(pid) { L300: fs.writeFileSync(getPidPath(), String(pid), 'utf-8'); L301: } ... L314: try { L315: fs.writeFileSync(getHeartbeatPath(), JSON.stringify(hb), 'utf-8'); L316: } Write operation from scripts/postinstall.js: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); L15: const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims'); L16: // System repo lives inside the user repo (folded in v1.21). Legacy installs at

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/daemon/daemon.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.64 matchedPath = dist/lib/daemon/daemon.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.64 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/daemon/daemon.jsView on unpkg

dist/lib/installations/migrate.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.jsView on unpkg · L9

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 43

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/bootstrap.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/commands/setup.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/agent-spec/agents.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/agent-spec/agents.jsView on unpkg

dist/lib/models.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/models.jsView on unpkg

dist/lib/secrets/agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/secrets/agent.jsView on unpkg

dist/lib/self-update.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/self-update.jsView on unpkg

dist/lib/session/discover.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/session/discover.jsView on unpkg

dist/lib/tmux/binary.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/commands/computer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/computer.jsView on unpkg

Source & flagged code

23 flagged

package.jsonView file

Lines 30-70json

30 "CHANGELOG.md",

31 "README.md",

32 "LICENSE"

33 ],

34 "publishConfig": {

35 "provenance": true

36 },

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/phnx-labs/agi-cli.git"

40 },

41 "homepage": "https://agents-cli.sh",

42 "bugs": {

43 "url": "https://github.com/phnx-labs/agi-cli/issues"

44 },

45 "scripts": {

47 "build:bin": "scripts/build-bin.sh",

48 "prepare": "npm run build",

49 "prepack": "cp ../README.md README.md",

50 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/index.ts",

52 "changelog": "bun scripts/gen-changelog.ts",

53 "gen:index": "bun scripts/gen-command-index.ts",

54 "verify:index": "bash scripts/verify-command-index.sh",

55 "start": "node dist/index.js",

56 "test": "node ./node_modules/vitest/vitest.mjs run",

57 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

59 "test:remote": "scripts/sandbox.sh test",

60 "verify-docs": "scripts/verify-docs.sh",

61 "test:watch": "node ./node_modules/vitest/vitest.mjs"

62 },

63 "keywords": [

64 "agents",

65 "cli",

66 "dotfiles",

67 "claude",

68 "codex",

69 "cursor",

70 "opencode",

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/installations/migrate.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.jsView on unpkg · L9

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 43

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/bootstrap.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bootstrap.jsView on unpkg

dist/commands/setup.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/agent-spec/agents.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/agent-spec/agents.jsView on unpkg

dist/lib/models.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/models.jsView on unpkg

dist/lib/secrets/agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/secrets/agent.jsView on unpkg

dist/lib/self-update.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/self-update.jsView on unpkg

dist/lib/session/discover.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/session/discover.jsView on unpkg

dist/lib/tmux/binary.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/commands/computer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/computer.jsView on unpkg

@phnx-labs/agents-cli@1.22.65

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code