registry / @phnx-labs/agents-cli / 1.22.69

@phnx-labs/agents-cli@1.22.69

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic postinstall persistence and PATH mutation create a real agent-extension lifecycle risk, but the inspected code does not establish malicious payload delivery, secret theft, or broad foreign-agent control-surface mutation. A warning is appropriate rather than a publication block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation that runs postinstall on macOS or Linux, unless CI or AGENTS_NO_HEAL=1 is set.

Impact

The package can gain durable execution through its own user-level agent infrastructure and affect how AI-agent commands resolve.

Mechanism

Postinstall PATH repair and persistent daemon activation.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/lib/platform/posixpath.jsdist/lib/daemon/daemon.js~/.agents~/.local/bin/agents~/.local/bin/ag~/.bash_profile~/.profile

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs scripts/postinstall.js automatically after installation.
On POSIX, postinstall can create ~/.local/bin command links and append ~/.local/bin to a login shell profile without a prompt.
On macOS and Linux, postinstall can start or restart an always-on agents daemon.
The package manages configurations and commands for multiple AI-agent products, making its persistent setup a meaningful control-surface risk.

Evidence against

No runtime dependency on this package itself was found in package.json.
The installer preserves existing non-package symlinks and only retargets links already resolving to its own entry point.
Shell initialization normally requires an interactive confirmation or an explicit environment variable.
The reviewed sources did not show credential exfiltration, covert network access during postinstall, or remote payload execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

23 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

Lines 155-195javascript

155 * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),

156 * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`

157 * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`

158 * pair maps onto the 1password source. A file literally named `icloud` or

159 * `1password` can still be imported via an explicit path (`./icloud`).

160 */

161export function parseImportSource(opts) {

162 if (opts.from && opts.from1password) {

163 throw new Error('--from and --from-1password are mutually exclusive.');

164 }

165 if (opts.from1password)

166 return { kind: '1password', vault: opts.vault };

167 if (!opts.from) {

168 throw new Error("Pass --from <source>: a .env path (- reads stdin), '1password:<vault>', or 'icloud'.");

169 }

170 if (opts.from === 'icloud')

171 return { kind: 'icloud' };

172 if (opts.from === '1password')

173 return { kind: '1password', vault: opts.vault };

174 if (opts.from.startsWith('1password:')) {

175 const vault = opts.from.slice('1password:'.length);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/secrets.jsView on unpkg · L175

176 return { kind: '1password', vault: vault || opts.vault };

177 }

178 return { kind: 'dotenv', path: opts.from };

179}

180/**

181 * `secrets import --from icloud` — recover bundles stranded in the iCloud

182 * Keychain by the device-local cutover. With a bundle name, imports exactly

183 * that bundle; without one, interactively multi-selects from everything

184 * discovered (all pre-checked — the common case is "bring them all back").

185 */

186async function importFromICloud(bundleName, opts) {

187 if (process.platform !== 'darwin') {

188 throw new Error('--from icloud reads the macOS iCloud Keychain and is only available on macOS.');

189 }

190 const candidates = discoverSyncedBundles();

191 if (candidates.length === 0) {

192 console.log('No legacy iCloud Keychain bundles found.');

193 return;

194 }

195 const describe = (c) => `${c.name} (${c.keys.length} key${c.keys.length === 1 ? ''

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/commands/secrets.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/secrets.jsView on unpkg

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors `src/lib/secrets/install-helper.ts` (stable Application Support path,

5 * survives npm re-sign) and the secrets-agent launchd pattern in

6 * `src/lib/secrets/agent.ts` (RunAtLoad + KeepAlive user service).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/commands/setup-fleet.jsView file

8import chalk from 'chalk'; L9: import { spawnSync } from 'node:child_process'; L10: import { getCliLaunch } from '../lib/cli-entry.js'; ... L24: const launch = getCliLaunch(args); L25: const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env }); L26: if ((res.status ?? 1) === 0) ... L49: console.error(chalk.red('Tailscale is not installed or not on PATH.')); L50: const platform = process.platform; L51: console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:')); ... L53: console.log(chalk.cyan(' brew install --cask tailscale')); L54: console.log(chalk.gray(' or install from https://tailscale.com/download/mac')); L55: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/setup-fleet.jsView on unpkg · L8

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/installations/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function migraterunsintoroutines() { const src = path.join(user_dir, 'runs'); const dest = path.join(user_dir, 'routines', 'runs'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.mkdirsync(path.dirname(dest), { recursive: true, mode: 0o700 }); fs.renamesync(src, dest); } catch { } } function migratetrashtohidden() { const src = path.join(user_dir, 'trash'); const dest = path.join(user_dir, '.trash'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.renamesync(src, dest); } catch {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

9Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js L9: import * as readline from 'readline'; L10: import { spawnSync } from 'child_process'; L11: import { fileURLToPath } from 'url'; L12: L13: const HOME = os.homedir(); L14: const USER_DIR = path.join(HOME, '.agents'); ... L27: function resolveAgentsBin() { L28: if (process.platform !== 'darwin') return AGENTS_JS_ENTRYPOINT; L29: try { ... L53: // can't take down the rest of postinstall. install-helper.js stays silent L54: // on no-op and emits one stdout line on success. L55: spawnSync(process.execPath, [INSTALL_HELPER_SCRIPT], { stdio: 'inherit' });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.jsView on unpkg · L9

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 45

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/commands/setup.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/commands/setup.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/agent-spec/agents.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/agent-spec/agents.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/agent-spec/agents.jsView on unpkg

dist/lib/models.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/models.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/models.jsView on unpkg

dist/lib/secrets/agent.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/secrets/agent.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/secrets/agent.jsView on unpkg

dist/lib/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/self-update.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/self-update.jsView on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/commands/computer.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/commands/computer.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/computer.jsView on unpkg

dist/lib/browser/chrome.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/browser/chrome.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/browser/chrome.jsView on unpkg

dist/lib/browser/drivers/ssh.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/browser/drivers/ssh.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/browser/drivers/ssh.jsView on unpkg

dist/lib/browser/ffmpeg.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/browser/ffmpeg.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/browser/ffmpeg.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/secrets.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

1 Critical17 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/lib/daemon/daemon.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/commands/setup-fleet.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/installations/migrate.js

HighTrigger Reachable Persistencescripts/postinstall.js

HighSemantic Analysis Limiteddist/commands/computer.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/setup.js

HighKnown Malware Source Similaritydist/lib/agent-spec/agents.js

HighKnown Malware Source Similaritydist/lib/menubar/install-menubar.js

HighKnown Malware Source Similaritydist/lib/models.js

Affected versions and remediation

This report applies to @phnx-labs/agents-cli@1.22.69.

See all versions of @phnx-labs/agents-cli for other recorded verdicts.

Review the evidence and your use of @phnx-labs/agents-cli@1.22.69 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 11:04:15.647Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code