Loading npm security reports…

agents-chat-cli@3.50.0: AI-agent control-surface risk | LPM Firewall

registry / agents-chat-cli / 3.50.0

agents-chat-cli@3.50.0

多智能体群聊工具 - 支持 OpenCode/Claude Code/Codex/pi 内核，微信风格聊天界面

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package can modify the user's global npm AI-agent environment without an explicit command. It installs a separate AI command when no supported command is detected.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall, or a normal agents-chat start after lifecycle hooks were skipped.

Impact

A foreign AI-agent command is added to the user's global execution environment without install-time consent.

Mechanism

Automatic global installation of opencode-ai.

Policy narrative

The manifest automatically invokes a postinstall script. That script detects installed AI tools and, when none are found, executes a global npm installation of opencode-ai. The normal CLI start path repeats that action when lifecycle hooks were skipped, making the mutation persistent across installation methods. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The package uses an automatic lifecycle hook to globally install a separate AI-agent package, then retries the behavior at runtime. This meets the install-control-surface blocking boundary even though no direct credential exfiltration was found.

Evidence

package.jsonscripts/postinstall.jsapp/lib/kernel-setup.jsbin/agents-chat.js

Decision evidence

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agents-chat-cli@3.42.0 matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.42.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

app/server.jsView on unpkg

10const url = require('url'); L11: const { spawn } = require('child_process'); L12: const attachment = require('./lib/attachment');

High

Child Process

Package source references child process execution.

app/server.jsView on unpkg · L10

2// 启动：node app/server.js [--port 3456] L3: const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用） L4: const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L2

app/lib/kernel-setup.jsView file

55const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Shell

Package source references shell execution.

app/lib/kernel-setup.jsView on unpkg · L55

4// 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6: ... L17: // 执行安装并返回结果；log/inject 可注入（postinstall 用 console，单测用收集器） L18: function ensureDefaultKernel({ log = console.log, standalone = !!process.versions.bun || process.env.AGENTS_CHAT_STANDALONE === '1' } = {}) { L19: const { detectKernels } = require('./agent'); ... L54: } L55: const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/lib/kernel-setup.jsView on unpkg · L4

3// 单文件 exe 形态无 npm，跳过；AGENTS_CHAT_AUTO_INSTALL=0 可关闭。 L4: // 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/lib/kernel-setup.jsView on unpkg · L3

bin/agents-chat.jsView file

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid');

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/agents-chat.jsView on unpkg · L14

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/agents-chat.jsView on unpkg · L14

14Trigger-reachable chain: manifest.bin -> bin/agents-chat.js L14: L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

app/lib/agent.jsView file

12const ROOT = path.join(__dirname, '..', '..'); L13: const DATA_DIR = process.env.AGENTS_CHAT_DATA || path.join(ROOT, '.data'); L14: const MOCK_SCRIPT = path.join(__dirname, '..', 'mock', 'mock-agent.js'); ... L129: function resolveRunner() { L130: if (process.env.AGENTS_CHAT_MOCK === '1') { L131: return { kind: 'demo', configured: false }; ... L171: function buildKernelArgs(kernelId, agent, sessionId) { L172: const model = agent.model || process.env.AGENTS_CHAT_MODEL || ''; L173: ... L179: // 因此默认加 --auto，.env 可用 AGENTS_CHAT_AUTO_APPROVE=0 关闭 L180: if (process.env.AGENTS_CHAT_AUTO_APPROVE !== '0') args.push('--auto'); L181: return args;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

app/lib/agent.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.49.0 matchedPath = app/lib/agent.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.49.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/agent.jsView on unpkg

app/lib/oc.jsView file

•matchType = token_shingles matchedPackage = agents-chat-cli@3.49.0 matchedPath = app/lib/oc.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.49.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/oc.jsView on unpkg

app/lib/orchestrator.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.48.0 matchedPath = app/lib/orchestrator.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.48.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/orchestrator.jsView on unpkg

scripts/build-desktop.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.48.0 matchedPath = scripts/build-desktop.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.48.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-desktop.jsView on unpkg

scripts/build-exe.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.48.0 matchedPath = scripts/build-exe.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.48.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-exe.jsView on unpkg

app/lib/attachment-config.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.48.0 matchedPath = app/lib/attachment-config.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.48.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/attachment-config.jsView on unpkg