registry / Remote code execution / agents-chat-cli / 3.42.0

agents-chat-cli@3.42.0

多智能体群聊工具 - 支持 OpenCode/Claude Code/Codex/pi 内核，微信风格聊天界面

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a concrete unauthenticated web-shell exposure and automatically installs a third-party AI CLI during postinstall. Its functionality is largely transparent, so the source supports a high-risk warning rather than a malware conclusion.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled, or starting the CLI server and sending HTTP requests to its terminal endpoint.

Impact

A reachable client can execute shell commands as the service user; automatic agent permissions can also modify the configured workspace.

Mechanism

Automatic global AI CLI installation plus an unauthenticated web shell and auto-approved agent runners.

AI rationale

Evidence

package.jsonscripts/postinstall.jsapp/lib/kernel-setup.jsapp/server.jsapp/lib/agent.js

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The manifest runs a postinstall hook automatically.
The install hook invokes a kernel setup routine that globally installs a third-party AI CLI when none is detected.
The HTTP server exposes an endpoint that writes request data directly to a persistent shell's standard input, with no authentication checks in that route.
The server listens without an explicit loopback host restriction.
Agent executions default to permission-bypassing or auto-approval modes.

Evidence against

The global install is limited to a named package and can be disabled through an environment variable.
The package contains no self-dependency, obfuscated payload, credential harvesting, or hard-coded exfiltration endpoint.
The shell and agent features are consistent with the package's interactive agent-workbench functionality.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/server.jsView file

9const url = require('url'); L10: const { spawn } = require('child_process'); L11:

High

Child Process

Package source references child process execution.

app/server.jsView on unpkg · L9

5const { notifyDone } = require('./lib/notify'); L6: const http = require('http'); L7: const fs = require('fs'); ... L9: const url = require('url'); L10: const { spawn } = require('child_process'); L11: ... L15: (function setupHeadlessLogging() { L16: if (process.env.AGENTS_CHAT_STANDALONE !== '1') return; L17: let writable = true;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/server.jsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.41.0 matchedPath = app/server.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/server.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d9b244794a2ea243 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = agents-chat-cli@3.41.0 matchedPath = app/server.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.41.0 similarity = 1.000 shingleOverlap = 22 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

app/server.jsView on unpkg

2// 启动：node app/server.js [--port 3456] L3: const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用） L4: const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L2

bin/agents-chat.jsView file

194if (process.platform === 'win32') { L195: execSync('powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.Name -match \'node\' -and $_.CommandLine -like \'*app\\\\server.js*\' } | ForEach-Object... L196: }

High

Shell

Package source references shell execution.

bin/agents-chat.jsView on unpkg · L194

14Trigger-reachable persistence chain: manifest.bin -> bin/agents-chat.js L14: L15: const { spawn, execSync } = require('child_process'); L16: const fs = require('fs'); ... L19: L20: const PKG = require('../package.json'); L21: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L22: L23: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L24: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L25: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L42: try { L43: execSync(`curl -s -m 2 http://localhost:${PORT}/api/health`, { stdio: 'pipe' });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/agents-chat.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.43.3 matchedPath = bin/agents-chat.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.43.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/agents-chat.js

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L1: #!/usr/bin/env node L2: // npm 安装钩子：全无 AI 内核时自动安装 opencode，小白开箱即用 Referenced control path from app/lib/kernel-setup.js: L17: // 执行安装并返回结果；log/inject 可注入（postinstall 用 console，单测用收集器） L18: function ensureDefaultKernel({ log = console.log, standalone = !!process.versions.bun || process.env.AGENTS_CHAT_STANDALONE === '1' } = {}) { L19: const { detectKernels } = require('./agent'); ... L21: standalone, L22: disabled: process.env.AGENTS_CHAT_AUTO_INSTALL === '0' L23: }); Write operation from app/lib/agent.js: L12: const ROOT = path.join(__dirname, '..', '..'); L13: const DATA_DIR = process.env.AGENTS_CHAT_DATA || path.join(ROOT, '.data'); L14: const MOCK_SCRIPT = path.join(__dirname,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

app/lib/kernel-setup.jsView file

3// 单文件 exe 形态无 npm，跳过；AGENTS_CHAT_AUTO_INSTALL=0 可关闭。 L4: // 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/lib/kernel-setup.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.43.3 matchedPath = app/lib/kernel-setup.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.43.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/kernel-setup.jsView on unpkg

app/lib/oc.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.43.3 matchedPath = app/lib/oc.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.43.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/oc.jsView on unpkg

app/lib/agent.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.41.0 matchedPath = app/lib/agent.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/agent.jsView on unpkg

app/lib/orchestrator.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.43.0 matchedPath = app/lib/orchestrator.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.43.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/orchestrator.jsView on unpkg

scripts/build-exe.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.41.0 matchedPath = scripts/build-exe.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-exe.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/server.jsView file

Findings

1 Critical15 High6 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processapp/server.js

HighShellbin/agents-chat.js

HighSame File Env Network Executionapp/server.js

HighTrigger Reachable Persistencebin/agents-chat.js

HighRuntime Package Installapp/lib/kernel-setup.js

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similarityapp/server.js

HighKnown Malware Source Similarityapp/lib/oc.js

HighKnown Malware Source Similaritybin/agents-chat.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to agents-chat-cli@3.42.0.

See all versions of agents-chat-cli for other recorded verdicts.

Review the evidence and your use of agents-chat-cli@3.42.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-31 18:40:51.679Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code