registry / @phnx-labs/agents-cli / 1.23.25

@phnx-labs/agents-cli@1.23.25

⚠ Under review

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The readable install hook performs CLI setup and prompts before changing shell configuration, and no concrete attack was verified. The required plugin and session-discovery modules contain unreadable bytes, so manual review is needed to resolve their behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Unresolved; the unreadable modules may be reached during CLI operation.

Impact

No specific impact is established; the unresolved modules prevent a clean determination.

Mechanism

The available source inspection could not determine the behavior of the plugin and session-discovery modules.

AI rationale

Evidence

dist/lib/plugins/plugins.jsdist/lib/session/discover.js

Decision evidence

public snapshot

AI called this Manual Review at 77.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest runs scripts/postinstall.js after installation.
The interactive postinstall asks before appending a PATH change to the shell configuration.
Owner notifications send a bearer credential to the RUSH API base, which defaults to api.prix.dev and can be overridden by RUSH_PROXY_BASE.

Evidence against

The inspected source does not establish a hostile recipient or a concrete attack.
dist/lib/plugins/plugins.js and dist/lib/session/discover.js could not be read as source, leaving required behavior unresolved.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 769 file(s), 6.73 MB of source, external domains: 127.0.0.1, ai.azure.com, anthropic.com, antigravity.google, api.anthropic.com, api.cloudflare.com, api.cursor.com, api.deepinfra.com, api.example.com, api.factory.ai, api.hetzner.cloud, api.kimi.com, api.linear.app, api.meta.ai, api.openai.com, api.prix.dev, app.factory.ai, app.warp.dev, aws.amazon.com, cloud.google.com, cloudcode-pa.googleapis.com, code.kimi.com, console.anthropic.com, console.hetzner.cloud, console.x.ai, cursor.com, daily-cloudcode-pa.googleapis.com, deepinfra.com, dev.meta.ai, docs.openclaw.ai, docs.x.ai, example.com, generativelanguage.googleapis.com, git-scm.com, github.com, gw.corp, hermes-agent.nousresearch.com, id.byphoenix.com, linear.app, login.tailscale.com, nodejs.org, oauth2.googleapis.com, opencode.ai, openrouter.ai, prix.dev, raw.githubusercontent.com, registry.modelcontextprotocol.io, registry.npmjs.org, slack.com, tailscale.com

Source & flagged code

19 flagged

package.jsonView file

Lines 29-69json

29 "CHANGELOG.md",

30 "README.md",

31 "LICENSE"

32 ],

33 "publishConfig": {

34 "provenance": true

35 },

36 "repository": {

37 "type": "git",

38 "url": "git+https://github.com/phnx-labs/agi-cli.git"

39 },

40 "homepage": "https://agents-cli.sh",

41 "bugs": {

42 "url": "https://github.com/phnx-labs/agi-cli/issues"

43 },

44 "scripts": {

45 "build": "tsc && rm -rf 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

46 "build:bin": "scripts/build-bin.sh",

47 "prepare": "npm run build",

48 "prepack": "cp ../README.md README.md",

49 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "dev": "tsx src/index.ts",

51 "changelog": "bun scripts/gen-changelog.ts",

52 "gen:index": "bun scripts/gen-command-index.ts",

53 "verify:index": "bash scripts/verify-command-index.sh",

54 "start": "node dist/index.js",

55 "test": "TZ=UTC node ./node_modules/vitest/vitest.mjs run",

56 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

57 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

58 "test:remote": "scripts/sandbox.sh test",

59 "verify-docs": "scripts/verify-docs.sh",

60 "test:watch": "node ./node_modules/vitest/vitest.mjs"

61 },

62 "keywords": [

63 "agents",

64 "cli",

65 "dotfiles",

66 "claude",

67 "codex",

68 "cursor",

69 "opencode",

dist/lib/sqlite.jsView file

Lines 1-22javascript

1import { createRequire } from 'module';

2const isBun = typeof globalThis.Bun !== 'undefined';

3const require = createRequire(

dist/lib/platform/ipc.jsView file

Lines 1-9javascript

1import * as crypto from 'crypto';

2export function ipcEndpoint(socketPath, platform = process.platform) {

3 if (platform ===

dist/lib/menubar/install-menubar.jsView file

Lines 1-21javascript

1import { fileURLToPath } from 'url';

2import { execFileSync, spawnSync, spawn } from 'child_process';

3import * as fs from 'fs';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/setup-fleet.jsView file

Lines 1-21javascript

1import chalk from 'chalk';

2import { spawnSync } from 'node:child_process';

3import { getCliLaunch } from '../lib/cli-entry.js';

4import { loadDevices } from '../lib/devices/registry.js'

dist/lib/daemon/daemon.jsView file

Lines 1-31javascript

1import { daemonProcessViewAllowed, recordDaemonProcessView } from '../session/process-view.js';

2import { spawn, execFileSync } from 'child_process';

3import * as fs from 'fs';

4import

dist/lib/state.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import * as fs from 'fs'; import * as path from 'path'; import * as os from 'os'; import * as yaml from 'yaml'; import { stringifydoc } from './yaml-io.js'; import { execfilesync } from 'child_process'; import { ensurelocktarget, atomicwritefilesync, withfilelock } from './fs-atomic.js'; import { default_system_repo, systemreposlug } from './types.js'; import { machineid } from './machine-id.js'; const home = process.env.home ?? os.homedir(); function issamepath(a, b) { try { return fs.realpathsync.native(a) === fs.realpathsync.native(b); } catch { const norm = (p) => process.platform === 'win32' ? path.resolve(p).tolowercase() : path.resolve(p);

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/state.jsView on unpkg

scripts/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// Runs after npm install -g @phnx-labs/agents-cli.

4import * as fs from 'fs';

5import * as path from 'path';

dist/session-tracker/dist/hook.shView file

•path = dist/session-tracker/dist/hook.sh kind = build_helper sizeBytes = 4499 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/session-tracker/dist/hook.shView on unpkg

dist/commands/daemon.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/daemon.js#virtual:normalized:round1View on unpkg

dist/lib/session/discover.jsView file

•matchType = token_shingles matchedPackage = @phnx-labs/agents-cli@1.22.109 matchedPath = dist/lib/session/discover.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.109 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/session/discover.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @phnx-labs/agents-cli@1.23.24 matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.23.24 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/session/discover.jsView on unpkg

dist/lib/tmux/binary.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/tmux/binary.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/tmux/binary.jsView on unpkg

dist/lib/loop.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/loop.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/loop.jsView on unpkg

dist/lib/models.jsView file

•matchType = token_shingles matchedPackage = @phnx-labs/agents-cli@1.22.109 matchedPath = dist/lib/models.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.109 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/models.jsView on unpkg

dist/lib/session/provenance.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/session/provenance.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/session/provenance.jsView on unpkg

dist/lib/teams/forEach.jsView file

•matchType = normalized_sha256 matchedPackage = @phnx-labs/agents-cli@1.22.53 matchedPath = dist/lib/teams/forEach.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/teams/forEach.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib/sqlite.jsView file

2const isBun = typeof globalThis.Bun !== 'undefined'; L3: const require = createRequire(import.meta.url); L4: function loadNodeSqlite() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/sqlite.jsView on unpkg · L2

Findings

1 Critical13 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/lib/daemon/daemon.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/commands/setup-fleet.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/state.js

HighTrigger Reachable Persistencescripts/postinstall.js

HighSemantic Analysis Limiteddist/commands/daemon.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/lib/session/discover.js

HighKnown Malware Source Similaritydist/lib/tmux/binary.js

HighKnown Malware Source Similaritydist/lib/loop.js

HighKnown Malware Source Similaritydist/lib/models.js

Affected versions and remediation

This report applies to @phnx-labs/agents-cli@1.23.25.

See all versions of @phnx-labs/agents-cli for other recorded verdicts.

Review the evidence and your use of @phnx-labs/agents-cli@1.23.25 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 21:12:42.574Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code