agents-chat-cli@3.51.0: Malicious npm security report (Block)

Loading npm security reports…

agents-chat-cli@3.51.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

23 flagged

package.jsonView file

Lines 24-55json

24 ],

25 "license": "MIT",

26 "author": "iamsamyiok",

27 "engines": {

28 "node": ">=18.0.0"

29 },

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/iamsamyiok/agents-chat"

33 },

34 "bugs": {

35 "url": "https://github.com/iamsamyiok/agents-chat/issues"

36 },

37 "homepage": "https://github.com/iamsamyiok/agents-chat",

38 "scripts": {

39 "start": "node app/server.js",

40 "test": "node --test --test-force-exit \"test/*.test.js\"",

41 "build:exe": "node scripts/build-exe.js",

42 "desktop:dev": "electron desktop/main.js",

43 "desktop:build": "node scripts/build-desktop.js",

44 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "devDependencies": {

47 "electron": "^33.2.0",

48 "electron-builder": "^25.1.8"

49 },

50 "dependencies": {

51 "@larksuiteoapi/node-sdk": "^1.73.3",

52 "axios": "^1.20.0"

53 }

54}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

app/server.jsView file

Lines 1-30javascript

1// Agents Chat Portable - 零依赖 HTTP 服务

2// 启动：node app/server.js [--port 3456]

3const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用）

4const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck'

app/lib/kernel-setup.jsView file

Lines 35-70javascript

35 } catch (err) {

36 log('✗ 自动安装失败（通常是全局目录权限不足），请手动执行其中一条：');

37 log(' Windows: npm install -g opencode-ai');

38 log(' Linux/macOS: sudo npm install -g opencode-ai');

39 return { installed: false

bin/agents-chat.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * agents-chat CLI 入口

4 *

5 * 用法:

6 * agents-chat # 启动服务（后台运行）

7 * agents-chat start # 同上

8 * agents-chat stop # 停止服务

9 * agents-chat status # 查看服务状态（含版本与更新检查）

10 * agents-chat open # 仅打开浏览器

11 * agents-chat update # 检查并一键升级到 npm 最新版

app/lib/agent.jsView file

12const ROOT = path.join(__dirname, '..', '..'); L13: const DATA_DIR = process.env.AGENTS_CHAT_DATA || path.join(ROOT, '.data'); L14: const MOCK_SCRIPT = path.join(__dirname, '..', 'mock', 'mock-agent.js'); ... L129: function resolveRunner() { L130: if (process.env.AGENTS_CHAT_MOCK === '1') { L131: return { kind: 'demo', configured: false }; ... L171: function buildKernelArgs(kernelId, agent, sessionId) { L172: const model = agent.model || process.env.AGENTS_CHAT_MODEL || ''; L173: ... L179: // 因此默认加 --auto，.env 可用 AGENTS_CHAT_AUTO_APPROVE=0 关闭 L180: if (process.env.AGENTS_CHAT_AUTO_APPROVE !== '0') args.push('--auto'); L181: return args;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

app/lib/agent.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.50.0 matchedPath = app/lib/agent.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/agent.jsView on unpkg

app/lib/oc.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.50.0 matchedPath = app/lib/oc.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/oc.jsView on unpkg

app/lib/orchestrator.jsView file

•matchType = token_shingles matchedPackage = agents-chat-cli@3.50.0 matchedPath = app/lib/orchestrator.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.50.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/orchestrator.jsView on unpkg

scripts/build-desktop.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.50.0 matchedPath = scripts/build-desktop.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-desktop.jsView on unpkg

scripts/build-exe.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.50.0 matchedPath = scripts/build-exe.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-exe.jsView on unpkg

app/lib/attachment-config.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.50.0 matchedPath = app/lib/attachment-config.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/attachment-config.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agents-chat-cli@3.42.0 matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.42.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

app/server.jsView on unpkg

10const url = require('url'); L11: const { spawn } = require('child_process'); L12: const attachment = require('./lib/attachment');

High

Child Process

Package source references child process execution.

app/server.jsView on unpkg · L10

2// 启动：node app/server.js [--port 3456] L3: const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用） L4: const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L2

app/lib/kernel-setup.jsView file

55const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Shell

Package source references shell execution.

app/lib/kernel-setup.jsView on unpkg · L55

4// 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6: ... L17: // 执行安装并返回结果；log/inject 可注入（postinstall 用 console，单测用收集器） L18: function ensureDefaultKernel({ log = console.log, standalone = !!process.versions.bun || process.env.AGENTS_CHAT_STANDALONE === '1' } = {}) { L19: const { detectKernels } = require('./agent'); ... L54: } L55: const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/lib/kernel-setup.jsView on unpkg · L4

3// 单文件 exe 形态无 npm，跳过；AGENTS_CHAT_AUTO_INSTALL=0 可关闭。 L4: // 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/lib/kernel-setup.jsView on unpkg · L3

bin/agents-chat.jsView file

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid');

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/agents-chat.jsView on unpkg · L14

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/agents-chat.jsView on unpkg · L14

14Trigger-reachable chain: manifest.bin -> bin/agents-chat.js L14: L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

app/lib/agent.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

app/lib/agent.jsView on unpkg · L12

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/agent.jsView on unpkg

app/lib/oc.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/oc.jsView on unpkg

app/lib/orchestrator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/orchestrator.jsView on unpkg

scripts/build-desktop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-desktop.jsView on unpkg

scripts/build-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-exe.jsView on unpkg

app/lib/attachment-config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/attachment-config.jsView on unpkg

Source & flagged code

23 flagged

package.jsonView file

Lines 24-55json

24 ],

25 "license": "MIT",

26 "author": "iamsamyiok",

27 "engines": {

28 "node": ">=18.0.0"

29 },

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/iamsamyiok/agents-chat"

33 },

34 "bugs": {

35 "url": "https://github.com/iamsamyiok/agents-chat/issues"

36 },

37 "homepage": "https://github.com/iamsamyiok/agents-chat",

38 "scripts": {

39 "start": "node app/server.js",

40 "test": "node --test --test-force-exit \"test/*.test.js\"",

41 "build:exe": "node scripts/build-exe.js",

42 "desktop:dev": "electron desktop/main.js",

43 "desktop:build": "node scripts/build-desktop.js",

44 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "devDependencies": {

47 "electron": "^33.2.0",

48 "electron-builder": "^25.1.8"

49 },

50 "dependencies": {

51 "@larksuiteoapi/node-sdk": "^1.73.3",

52 "axios": "^1.20.0"

53 }

54}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

app/server.jsView file

Lines 1-30javascript

1// Agents Chat Portable - 零依赖 HTTP 服务

2// 启动：node app/server.js [--port 3456]

3const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用）

4const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck'

app/lib/kernel-setup.jsView file

Lines 35-70javascript

35 } catch (err) {

36 log('✗ 自动安装失败（通常是全局目录权限不足），请手动执行其中一条：');

37 log(' Windows: npm install -g opencode-ai');

38 log(' Linux/macOS: sudo npm install -g opencode-ai');

39 return { installed: false

bin/agents-chat.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * agents-chat CLI 入口

4 *

5 * 用法:

6 * agents-chat # 启动服务（后台运行）

7 * agents-chat start # 同上

8 * agents-chat stop # 停止服务

9 * agents-chat status # 查看服务状态（含版本与更新检查）

10 * agents-chat open # 仅打开浏览器

11 * agents-chat update # 检查并一键升级到 npm 最新版

app/lib/agent.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

app/lib/agent.jsView on unpkg · L12

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/agent.jsView on unpkg

app/lib/oc.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/oc.jsView on unpkg

app/lib/orchestrator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/orchestrator.jsView on unpkg

scripts/build-desktop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-desktop.jsView on unpkg

scripts/build-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-exe.jsView on unpkg

app/lib/attachment-config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/attachment-config.jsView on unpkg

agents-chat-cli@3.51.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code