registry / @vox-ai/cli-darwin-x64 / 0.1.0-beta.43
@vox-ai/cli-darwin-x64@0.1.0-beta.43
⚠ Under reviewPrebuilt darwin-x64 binary for the vox.ai CLI
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package exposes a native executable, and the hash-bound offline analysis does not resolve its behavior. No attack is established, but the available source evidence is insufficient to clear the executable.
Static reason
No blocking static signals were detected.
Trigger
Running the installed `vox` command would activate `bin/vox`.
Impact
The executable’s effects cannot be determined from the inspected evidence.
Mechanism
The executable is a Mach-O binary; bounded embedded source windows do not show which code is reachable or cover its other native behavior.
AI rationale
The package exposes a native executable, and the hash-bound offline analysis does not resolve its behavior. No attack is established, but the available source evidence is insufficient to clear the executable.
Evidence
package.json.lpm-inspection-nWTyKs/0-9e7e9397991c.txtbin/vox
Decision evidence
public snapshotAI called this Manual Review at 99.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json maps the `vox` command to the native executable `bin/vox`.
- The hash-bound offline analysis covers only bounded embedded source windows and says it cannot establish executable reachability or rule out other native behavior.
Evidence against
- The inspected files do not establish concrete attack behavior.
Behavioral surface
Source & flagged code
3 flaggedbin/voxView file
•path = bin/vox
kind = native_binary
sizeBytes = 126370480
magicHex = [redacted]
Medium
package.jsonView file
17"bin": {
"vox": "bin/vox"
},
"files": [
"bin/vox",
"README.md",
"LICENSE"
],
"engines": {
"node": ">=20.17.0"
}
}
Low
Ai Review Evidence
package.json maps the `vox` command to the native executable `bin/vox`.
package.jsonView on unpkg · L17.lpm-inspection-nWTyKs/0-9e7e9397991c.txtView file
8limitations=["Bounded embedded source windows do not prove loader/bytecode reachability or absence of other native behavior; trace activation and actual sends before deciding"]
ORI
Findings
1 Medium2 Low
MediumShips Native Binarybin/vox
LowAi Review Evidencepackage.json
LowAi Review Evidence.lpm-inspection-nWTyKs/0-9e7e9397991c.txt
Affected versions and remediation
This report applies to @vox-ai/cli-darwin-x64@0.1.0-beta.43.
See all versions of @vox-ai/cli-darwin-x64 for other recorded verdicts.
- Review the evidence and your use of @vox-ai/cli-darwin-x64@0.1.0-beta.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.