registry / @phnx-labs/agents-cli / 1.22.89

@phnx-labs/agents-cli@1.22.89

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has an automatic install-time persistence mechanism, creating a meaningful lifecycle risk. Its inspected scope is package-owned and no concrete malicious payload or exfiltration was found, so a warning is more proportionate than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package globally; local installation still creates the user's .agents directory.

Impact

A background process can remain active and package aliases can intercept matching shell commands.

Mechanism

Postinstall shim creation and daemon service registration.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/lib/daemon/daemon.js~/.agents~/.agents/.cache/shims~/.local/bin/agents~/.local/bin/agper-user launchd plist or systemd unit

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The npm postinstall hook runs package code automatically.
The installer writes executable command shims under the user's .agents directory.
On global installation, the hook starts or restarts an always-on daemon without an explicit CLI command.
The daemon creates and enables per-user launchd or systemd persistence.

Evidence against

The manifest has no runtime dependency on this package itself.
The inspected installer contains no network request or credential collection.
The writes and service are package-owned, rather than confirmed mutation of another agent's configuration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

22 flagged

package.jsonView file

Lines 30-70json

30 "CHANGELOG.md",

31 "README.md",

32 "LICENSE"

33 ],

34 "publishConfig": {

35 "provenance": true

36 },

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/phnx-labs/agi-cli.git"

40 },

41 "homepage": "https://agents-cli.sh",

42 "bugs": {

43 "url": "https://github.com/phnx-labs/agi-cli/issues"

44 },

45 "scripts": {

46 "build": "tsc && rm -rf 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

47 "build:bin": "scripts/build-bin.sh",

48 "prepare": "npm run build",

49 "prepack": "cp ../README.md README.md",

50 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/index.ts",

52 "changelog": "bun scripts/gen-changelog.ts",

53 "gen:index": "bun scripts/gen-command-index.ts",

54 "verify:index": "bash scripts/verify-command-index.sh",

55 "start": "node dist/index.js",

56 "test": "TZ=UTC node ./node_modules/vitest/vitest.mjs run",

57 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

58 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

59 "test:remote": "scripts/sandbox.sh test",

60 "verify-docs": "scripts/verify-docs.sh",

61 "test:watch": "node ./node_modules/vitest/vitest.mjs"

62 },

63 "keywords": [

64 "agents",

65 "cli",

66 "dotfiles",

67 "claude",

68 "codex",

69 "cursor",

70 "opencode",

dist/lib/sqlite.jsView file

Lines 1-35javascript

1/**

2 * Runtime-aware compatibility shim for SQLite.

3 *

4 * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids

5 * the native `better-sqlite3` addon entirely so there is no prebuild compile

6 * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`

7 * runs under Node, while the signed standalone `dist/bin/agents` (what the

8 * shims exec) embeds Bun.

9 *

10 * Exposes the small better-sqlite3-shaped surface area the rest of the

dist/lib/platform/ipc.jsView file

Lines 1-22javascript

1/**

2 * Local-daemon IPC endpoint, platform-aware.

3 */

4import * as crypto from 'crypto';

5/**

6 * Resolve the address a local daemon listens on / clients connect to.

7 *

8 * POSIX: the AF_UNIX socket file path itself.

dist/lib/menubar/install-menubar.jsView file

Lines 1-37javascript

1/**

2 * Install + lifecycle for the macOS menu-bar helper (`MenubarHelper.app`).

3 *

4 * Mirrors the stable-Application-Support-path-survives-npm-re-sign pattern and

5 * a RunAtLoad + KeepAlive user service, the same shape the deleted embedded

6 * secrets-agent used before it moved to the standalone secrets-cli (PHNX-3989).

7 *

8 * The helper is a no-Dock `.accessory` status-bar app. It reads live agent

9 * state directly from disk and shells `agents` only for actions, so the plist

10 * bakes in the node interpreter + entry point + bin path so the GUI process can

dist/commands/setup-fleet.jsView file

Lines 1-28javascript

1/**

2 * `agents setup fleet` — guided Tailscale device onboarding.

3 *

4 * This wizard is a front door over the existing fleet/device commands: sync

5 * Tailscale into the registry, choose auth, render SSH config, test devices, and

6 * optionally run the fleet updater without reimplementing those subcommands.

7 */

8import chalk from 'chalk';

dist/lib/daemon/daemon.jsView file

Lines 1-33javascript

1/**

2 * Daemon lifecycle management for the routines scheduler.

3 *

4 * The daemon is a long-running process that holds a JobScheduler and

5 * triggers jobs on their cron schedules. It can be managed via launchd

6 * (macOS), systemd (Linux), or as a plain detached process. PID tracking,

7 * log output, reload (SIGHUP), and graceful shutdown are handled here.

8 */

9import { spawn, execFileSync } from 'child_process'

dist/lib/installations/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function migraterunsintoroutines() { const src = path.join(user_dir, 'runs'); const dest = path.join(user_dir, 'routines', 'runs'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.mkdirsync(path.dirname(dest), { recursive: true, mode: 0o700 }); fs.renamesync(src, dest); } catch { } } function migratetrashtohidden() { const src = path.join(user_dir, 'trash'); const dest = path.join(user_dir, '.trash'); if (!fs.existssync(src) || fs.existssync(dest)) return; try { fs.renamesync(src, dest); } catch {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/installations/migrate.jsView on unpkg

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Runs after npm install -g @phnx-labs/agents-cli

3// Sets up shims directory and prints PATH instructions.

4// Set AGENTS_INIT_SHELL=1 to opt in to automatic shell-rc mutation.

6import * as fs from 'fs';

7import *

dist/commands/computer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 46

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/computer.js#virtual:normalized:round1View on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.66 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High