Loading npm security reports…

agents-chat-cli@3.52.1: AI-agent control-surface risk | LPM Firewall

registry / agents-chat-cli / 3.52.1

agents-chat-cli@3.52.1

多智能体群聊工具 - 支持 OpenCode/Claude Code/Codex/pi 内核，微信风格聊天界面

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package can automatically install a separate global AI-agent CLI. This changes the user's global npm-managed command environment without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation of agents-chat-cli on a system without a detected supported AI CLI

Impact

A dependency install can add a foreign AI-agent executable and its transitive code to the user's global environment.

Mechanism

postinstall-triggered global installation of opencode-ai

Policy narrative

During npm installation, the postinstall hook calls kernel setup. If it does not find one of several AI command-line tools, it executes npm install -g opencode-ai. This is an automatic lifecycle mutation of a separate global AI-agent control surface rather than a user-invoked setup action.

AI rationale

The source establishes an unconsented postinstall chain that installs a foreign global AI-agent package. The opt-out and detection guard do not change that the mutation occurs automatically for affected users.

Evidence

package.jsonscripts/postinstall.jsapp/lib/kernel-setup.js

Decision evidence

public snapshot

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agents-chat-cli@3.42.0 matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.42.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

app/server.jsView on unpkg

10const url = require('url'); L11: const { spawn } = require('child_process'); L12: const attachment = require('./lib/attachment');

High

Child Process

Package source references child process execution.

app/server.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = app/server.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/server.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 21ffcc24c8b2dc43 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = agents-chat-cli@3.52.0 matchedPath = app/server.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 shingleOverlap = 32 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

app/server.jsView on unpkg

2// 启动：node app/server.js [--port 3456] L3: const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用） L4: const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L2

app/lib/kernel-setup.jsView file

55const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Shell

Package source references shell execution.

app/lib/kernel-setup.jsView on unpkg · L55

4// 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6: ... L17: // 执行安装并返回结果；log/inject 可注入（postinstall 用 console，单测用收集器） L18: function ensureDefaultKernel({ log = console.log, standalone = !!process.versions.bun || process.env.AGENTS_CHAT_STANDALONE === '1' } = {}) { L19: const { detectKernels } = require('./agent'); ... L54: } L55: const cmd = process.platform === 'win32' L56: ? 'powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://opencode.ai/install.ps1 | iex"' L57: : 'bash -c "curl -fsSL https://opencode.ai/install | bash"';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/lib/kernel-setup.jsView on unpkg · L4

3// 单文件 exe 形态无 npm，跳过；AGENTS_CHAT_AUTO_INSTALL=0 可关闭。 L4: // 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/lib/kernel-setup.jsView on unpkg · L3

bin/agents-chat.jsView file

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid');

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/agents-chat.jsView on unpkg · L14

14L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/agents-chat.jsView on unpkg · L14

14Trigger-reachable chain: manifest.bin -> bin/agents-chat.js L14: L15: const { spawn, execSync } = require('child_process'); L16: const http = require('http'); L17: const fs = require('fs'); ... L20: L21: const PKG = require('../package.json'); L22: const { checkLatest, UPDATE_COMMAND } = require('../app/lib/updatecheck'); L23: L24: const PORT = parseInt(process.env.AGENTS_CHAT_PORT || '3456', 10); L25: const PID_FILE = path.join(os.homedir(), '.agents-chat.pid'); L26: const LOG_FILE = path.join(os.homedir(), '.agents-chat.log'); ... L86: ...process.env,

app/lib/agent.jsView file

12const ROOT = path.join(__dirname, '..', '..'); L13: const DATA_DIR = process.env.AGENTS_CHAT_DATA || path.join(ROOT, '.data'); L14: const MOCK_SCRIPT = path.join(__dirname, '..', 'mock', 'mock-agent.js'); ... L129: function resolveRunner() { L130: if (process.env.AGENTS_CHAT_MOCK === '1') { L131: return { kind: 'demo', configured: false }; ... L171: function buildKernelArgs(kernelId, agent, sessionId) { L172: const model = agent.model || process.env.AGENTS_CHAT_MODEL || ''; L173: ... L179: // 因此默认加 --auto，.env 可用 AGENTS_CHAT_AUTO_APPROVE=0 关闭 L180: if (process.env.AGENTS_CHAT_AUTO_APPROVE !== '0') args.push('--auto'); L181: return args;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

app/lib/agent.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = app/lib/agent.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/agent.jsView on unpkg

app/lib/oc.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = app/lib/oc.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/oc.jsView on unpkg

app/lib/orchestrator.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = app/lib/orchestrator.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/orchestrator.jsView on unpkg

scripts/build-desktop.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = scripts/build-desktop.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-desktop.jsView on unpkg

scripts/build-exe.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = scripts/build-exe.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-exe.jsView on unpkg

app/lib/attachment-config.jsView file

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.52.0 matchedPath = app/lib/attachment-config.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.52.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/lib/attachment-config.jsView on unpkg