Loading npm security reports…

agents-chat-cli@3.48.0: Malicious npm security report (Block) | LPM Firewall

registry / agents-chat-cli / 3.48.0

agents-chat-cli@3.48.0

多智能体群聊工具 - 支持 OpenCode/Claude Code/Codex/pi 内核，微信风格聊天界面

AI Security Review

scanned 27d ago · by lpm-firewall-ai

npm installation runs a postinstall hook that detects installed AI CLIs and installs opencode-ai globally when none are found. This modifies a foreign, system-wide AI-agent command surface without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm when no supported AI CLI is detected.

Impact

Adds a globally available AI-agent package and executes its installation lifecycle in the consumer environment.

Mechanism

Postinstall-triggered global installation of a foreign AI CLI.

Attack narrative

During npm installation, package.json runs scripts/postinstall.js. That hook calls ensureDefaultKernel(), which checks for installed AI command-line tools. If none are present, it executes npm install -g opencode-ai with inherited terminal I/O. This is an automatic global installation of a separate AI-agent package, expanding the consumer's command surface and allowing the installed package's own lifecycle behavior to run without a user-issued setup command.

AI rationale

The package performs an unconsented postinstall mutation of a foreign, broadly available AI-agent control surface. The absence of credential theft does not neutralize that concrete install-time behavior.

Evidence

package.jsonscripts/postinstall.jsapp/lib/kernel-setup.js

Decision evidence

public snapshot

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agents-chat-cli@3.42.0 matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.42.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

app/server.jsView on unpkg

10const url = require('url'); L11: const { spawn } = require('child_process'); L12: const attachment = require('./lib/attachment');

High

Child Process

Package source references child process execution.

app/server.jsView on unpkg · L10

2// 启动：node app/server.js [--port 3456] L3: const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用） L4: const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L2

app/lib/kernel-setup.jsView file

55const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Shell

Package source references shell execution.

app/lib/kernel-setup.jsView on unpkg · L55

4// 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6: ... L17: // 执行安装并返回结果；log/inject 可注入（postinstall 用 console，单测用收集器） L18: function ensureDefaultKernel({ log = console.log, standalone = !!process.versions.bun || process.env.AGENTS_CHAT_STANDALONE === '1' } = {}) { L19: const { detectKernels } = require('./agent'); ... L54: } L55: const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/lib/kernel-setup.jsView on unpkg · L4

3// 单文件 exe 形态无 npm，跳过；AGENTS_CHAT_AUTO_INSTALL=0 可关闭。 L4: // 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/lib/kernel-setup.jsView on unpkg · L3

bin/agents-chat.jsView file

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid');

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/agents-chat.jsView on unpkg · L14

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/agents-chat.jsView on unpkg · L14

14Trigger-reachable chain: manifest.bin -> bin/agents-chat.js L14: L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

app/lib/agent.jsView file

12const ROOT = path.join(__dirname, '..', '..'); L13: const DATA_DIR = process.env.AGENTS_CHAT_DATA || path.join(ROOT, '.data'); L14: const MOCK_SCRIPT = path.join(__dirname, '..', 'mock', 'mock-agent.js'); ... L129: function resolveRunner() { L130: if (process.env.AGENTS_CHAT_MOCK === '1') { L131: return { kind: 'demo', configured: false }; ... L171: function buildKernelArgs(kernelId, agent, sessionId) { L172: const model = agent.model || process.env.AGENTS_CHAT_MODEL || ''; L173: ... L179: // 因此默认加 --auto，.env 可用 AGENTS_CHAT_AUTO_APPROVE=0 关闭 L180: if (process.env.AGENTS_CHAT_AUTO_APPROVE !== '0') args.push('--auto'); L181: return args;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

app/lib/agent.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.44.2 matchedPath = app/lib/agent.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.44.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/agent.jsView on unpkg

app/lib/orchestrator.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.49.0 matchedPath = app/lib/orchestrator.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.49.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/orchestrator.jsView on unpkg

scripts/build-desktop.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.49.0 matchedPath = scripts/build-desktop.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.49.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-desktop.jsView on unpkg

scripts/build-exe.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.49.0 matchedPath = scripts/build-exe.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.49.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-exe.jsView on unpkg

app/lib/attachment-config.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.49.0 matchedPath = app/lib/attachment-config.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.49.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/attachment-config.jsView on unpkg