registry / @phnx-labs/agents-cli / 1.22.88

@phnx-labs/agents-cli@1.22.88

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes automatic persistence and unattended self-update, which is a real lifecycle risk. It does not establish credential theft, exfiltration, or takeover of a foreign agent configuration, so a warning is more appropriate than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package, especially globally, runs the postinstall hook.

Impact

The package gains continuing execution and can replace its installed code after installation.

Mechanism

Lifecycle-created service persistence with unattended self-update.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/lib/daemon/daemon.jsdist/lib/daemon/self-update-service.jsdist/lib/self-update.js~/.agents~/.agents/.cache/shims~/.local/bin/agents~/Library/LaunchAgents/<daemon label>.plist~/.config/systemd/user/<daemon unit>

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The install lifecycle invokes code that starts an always-on agents daemon on macOS and Linux.
The daemon writes and enables per-user launchd or systemd persistence with restart/keep-alive behavior.
The persisted daemon periodically checks npm and can reinstall the package globally without a new user command.
The installer also creates agent state and command shims, and can amend a login-shell PATH file.

Evidence against

No credential harvesting or exfiltration path was confirmed in the inspected lifecycle and daemon code.
The persistence is scoped to this vendor's CLI rather than a confirmed foreign AI-agent control surface.
package.json has no runtime dependency on another release of this package.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

22 flagged

package.jsonView file

Lines 30-70json

30 "CHANGELOG.md",

31 "README.md",

32 "LICENSE"

33 ],

34 "publishConfig": {

35 "provenance": true

36 },

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/phnx-labs/agi-cli.git"

40 },

41 "homepage": "https://agents-cli.sh",

42 "bugs": {

43 "url": "https://github.com/phnx-labs/agi-cli/issues"

44 },

45 "scripts": {

46 "build": "tsc && rm -rf 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

47 "build:bin": "scripts/build-bin.sh",

48 "prepare": "npm run build",

49 "prepack": "cp ../README.md README.md",

50 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/index.ts",

52 "changelog": "bun scripts/gen-changelog.ts",

53 "gen:index": "bun scripts/gen-command-index.ts",

54 "verify:index": "bash scripts/verify-command-index.sh",

55 "start": "node dist/index.js",

56 "test": "TZ=UTC node ./node_modules/vitest/vitest.mjs run",

57 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

58 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

59 "test:remote": "scripts/sandbox.sh test",

60 "verify-docs": "scripts/verify-docs.sh",

61 "test:watch": "node ./node_modules/vitest/vitest.mjs"

62 },

63 "keywords": [

64 "agents",

65 "cli",

66 "dotfiles",

67 "claude",

68 "codex",

69 "cursor",

70 "opencode",

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors the stable-Application-Support-path-survives-npm-re-sign pattern and

5 * a RunAtLoad + KeepAlive user service, the same shape the deleted embedded

6 * secrets-agent used before it moved to the standalone secrets-cli (PHNX-3989).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/installations/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function migraterunsintoroutines() { const src = path.join(user_dir, 'runs'); const dest = path.join(user_dir, 'routines', 'runs'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.mkdirsync(path.dirname(dest), { recursive: true, mode: 0o700 }); fs.renamesync(src, dest); } catch { } } function migratetrashtohidden() { const src = path.join(user_dir, 'trash'); const dest = path.join(user_dir, '.trash'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.renamesync(src, dest); } catch {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Runs after npm install -g @phnx-labs/agents-cli

3// Sets up shims directory and prints PATH instructions.

4// Set AGENTS_INIT_SHELL=1 to opt in to automatic shell-rc mutation.

6import * as fs from 'fs';

7import *

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 44

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High