registry / AI-agent control-surface risk / agents-chat-cli

agents-chat-cli

多智能体群聊工具 - 支持 OpenCode/Claude Code/Codex/pi 内核，微信风格聊天界面

This report shows the evidence for agents-chat-cli@3.52.1. 22 of 27 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The source establishes an unconsented postinstall chain that installs a foreign global AI-agent package. The opt-out and detection guard do not change that the mutation occurs automatically for affected users.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation of agents-chat-cli on a system without a detected supported AI CLI

Impact

A dependency install can add a foreign AI-agent executable and its transitive code to the user's global environment.

Mechanism

postinstall-triggered global installation of opencode-ai

Policy narrative

During npm installation, the postinstall hook calls kernel setup. If it does not find one of several AI command-line tools, it executes npm install -g opencode-ai. This is an automatic lifecycle mutation of a separate global AI-agent control surface rather than a user-invoked setup action.

AI rationale

Evidence

package.jsonscripts/postinstall.jsapp/lib/kernel-setup.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

The package declares an automatic postinstall hook.
The postinstall hook invokes kernel setup during npm installation.
When no supported AI CLI is found, kernel setup runs a global npm installation of the separate opencode-ai agent CLI.

Evidence against

The install is skipped if a supported AI CLI is detected or the documented environment opt-out is set.
No package-source credential harvesting or unrelated data exfiltration was found in the inspected lifecycle path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 529 KB of source, external domains: 127.0.0.1, apihub.agnes-ai.com, github.com, mineru.net, open.feishu.cn, open.larksuite.com, opencode.ai, registry.npmjs.org, www.apple.com

Source & flagged code

25 flagged

package.jsonView file

Lines 24-55json

24 ],

25 "license": "MIT",

26 "author": "iamsamyiok",

27 "engines": {

28 "node": ">=18.0.0"

29 },

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/iamsamyiok/agents-chat"

33 },

34 "bugs": {

35 "url": "https://github.com/iamsamyiok/agents-chat/issues"

36 },

37 "homepage": "https://github.com/iamsamyiok/agents-chat",

38 "scripts": {

39 "start": "node app/server.js",

40 "test": "node --test --test-force-exit \"test/*.test.js\"",

41 "build:exe": "node scripts/build-exe.js",

42 "desktop:dev": "electron desktop/main.js",

43 "desktop:build": "node scripts/build-desktop.js",

44 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "devDependencies": {

47 "electron": "^33.2.0",

48 "electron-builder": "^25.1.8"

49 },

50 "dependencies": {

51 "@larksuiteoapi/node-sdk": "^1.73.3",

52 "axios": "^1.20.0"

53 }

54}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

app/server.jsView file

Lines 1-30javascript

1// Agents Chat Portable - 零依赖 HTTP 服务

2// 启动：node app/server.js [--port 3456]

3const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用）

4const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck'

app/lib/kernel-setup.jsView file

Lines 35-70javascript

35 } catch (err) {

36 log('✗ 自动安装失败（通常是全局目录权限不足），请手动执行其中一条：');

37 log(' Windows: npm install -g opencode-ai');

38 log(' Linux/macOS: sudo npm install -g opencode-ai');

39 return { installed: false

bin/agents-chat.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * agents-chat CLI 入口

4 *

5 * 用法:

6 * agents-chat # 启动服务（后台运行）

7 * agents-chat start # 同上

8 * agents-chat stop # 停止服务

9 * agents-chat status # 查看服务状态（含版本与更新检查）

10 * agents-chat open # 仅打开浏览器

11 * agents-chat update # 检查并一键升级到 npm 最新版

app/lib/agent.jsView file

12const ROOT = path.join(__dirname, '..', '..'); L13: const DATA_DIR = process.env.AGENTS_CHAT_DATA || path.join(ROOT, '.data'); L14: const MOCK_SCRIPT = path.join(__dirname, '..', 'mock', 'mock-agent.js'); ... L129: function resolveRunner() { L130: if (process.env.AGENTS_CHAT_MOCK === '1') { L131: return { kind: 'demo', configured: false }; ... L171: function buildKernelArgs(kernelId, agent, sessionId) { L172: const model = agent.model || process.env.AGENTS_CHAT_MODEL || ''; L173: ... L179: // 因此默认加 --auto，.env 可用 AGENTS_CHAT_AUTO_APPROVE=0 关闭 L180: if (process.env.AGENTS_CHAT_AUTO_APPROVE !== '0') args.push('--auto'); L181: return args;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

app/lib/agent.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = app/lib/agent.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High