npm JavaScript analyzed 1.74.0

@agentprojectcontext/apx

v1.74.0

npm

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

maintainer: tecnomanu
license: MIT
first seen: 2026-07-08
last seen: 2026-07-29
releases · 30d: 25
short id

Drift inferred · capture-to-capture

HIGH 2026-07-08 code analysis flagged dynamic code execution in @agentprojectcontext/apx

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.74.0 · analyzer v28 · 3d ago

skills & prompt files 22

danger signals4

dynamic code execution new Function() package/src/core/http-tools/browser.js :402 result = await page.evaluate(new Function(code));
suspicious endpoint api.telegram.org package/src/core/channels/telegram/media.js :12 export const API_BASE = "https://api.telegram.org";
suspicious endpoint api.telegram.org package/src/host/daemon/wakeup.js :54 const url = `https://api.telegram.org/bot${token}/sendMessage`;
suspicious endpoint t.me package/src/interfaces/cli/commands/setup.js :193 console.log(di(" Create a bot at https://t.me/BotFather → get the token."));

code evidence v1.74.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 743

filesystem 124

fs package/src/core/agent/a2a/reply.js :5 import fs from "node:fs";
fs package/src/core/agent/build-agent-system.js :9 import fs from "node:fs";
fs package/src/core/agent/memory.js :1 import fs from "node:fs";
fs package/src/core/agent/prompt-builder.js :16 import fs from "node:fs";
fs package/src/core/agent/prompts/modes/index.js :7 import fs from "node:fs";
fs package/src/core/agent/self-memory.js :16 import fs from "node:fs";
fs package/src/core/agent/skills/index-store.js :37 import fs from "node:fs";
fs package/src/core/agent/skills/loader.js :31 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/add-project.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/call-runtime.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/edit-file.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/import-agent.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/list-files.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/read-agent-memory.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/read-file.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/search-sessions.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/transcribe-audio.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/handlers/write-file.js :1 import fs from "node:fs";
fs package/src/core/agent/tools/registry-bridge.js :20 import fs from "node:fs";
fs package/src/core/apc/context-copy.js :4 import fs from "node:fs/promises";
fs package/src/core/apc/notes.js :4 import fs from "node:fs/promises";
fs package/src/core/apc/parser.js :2 import fs from "node:fs";
fs package/src/core/apc/paths.js :8 import fs from "node:fs";
fs package/src/core/apc/scaffold.js :1 import fs from "node:fs";
fs package/src/core/apc/skill-sync.js :2 import fs from "node:fs";
fs package/src/core/artifacts/preview.js :19 import fs from "node:fs";
fs package/src/core/channels/telegram/helpers.js :4 import fs from "node:fs";
fs package/src/core/channels/telegram/media.js :9 import fs from "node:fs";
fs package/src/core/config/index.js :5 import fs from "node:fs";
fs package/src/core/config/paths.js :3 import fs from "node:fs";
fs package/src/core/desktop/autostart.js :16 import fs from "node:fs";
fs package/src/core/desktop/process.js :10 import fs from "node:fs";
fs package/src/core/git-baseline.js :14 import fs from "node:fs";
fs package/src/core/http-tools/glob.js :10 import fs from "node:fs";
fs package/src/core/http-tools/grep.js :7 import fs from "node:fs";
fs package/src/core/identity/self.js :1 import fs from "node:fs";
fs package/src/core/integrations/obsidian-memory.js :6 import fs from "node:fs";
fs package/src/core/integrations/plugins/obsidian.js :12 import fs from "node:fs";
fs package/src/core/integrations/sources.js :13 import fs from "node:fs";
fs package/src/core/logging.js :1 import fs from "node:fs";
fs package/src/core/mcp/sources.js :36 import fs from "node:fs";
fs package/src/core/memory/active-threads.js :12 import fs from "node:fs";
fs package/src/core/memory/broker.js :13 import fs from "node:fs";
fs package/src/core/memory/compactor.js :23 import fs from "node:fs";
fs package/src/core/memory/index.js :18 import fs from "node:fs";
fs package/src/core/memory/indexer.js :20 import fs from "node:fs";
fs package/src/core/memory/store.js :28 import fs from "node:fs";
fs package/src/core/routines/runner.js :13 import fs from "node:fs";
fs package/src/core/stores/artifacts.js :4 import fs from "node:fs";
fs package/src/core/stores/code-sessions.js :12 import fs from "node:fs";
fs package/src/core/stores/conversations-compactor.js :25 import fs from "node:fs";
fs package/src/core/stores/conversations.js :4 import fs from "node:fs";
fs package/src/core/stores/engine-sessions.js :10 import fs from "node:fs";
fs package/src/core/stores/messages.js :19 import fs from "node:fs";
fs package/src/core/stores/organization.js :19 import fs from "node:fs";
fs package/src/core/stores/project-files.js :18 import fs from "node:fs";
fs package/src/core/stores/routine-memory.js :13 import fs from "node:fs";
fs package/src/core/stores/routines.js :3 import fs from "node:fs";
fs package/src/core/stores/runtime-callbacks.js :17 import fs from "node:fs";
fs package/src/core/stores/runtime-sessions.js :11 import fs from "node:fs";
fs package/src/core/stores/sessions-search.js :5 import fs from "node:fs";
fs package/src/core/stores/sessions.js :5 import fs from "node:fs";
fs package/src/core/stores/tasks.js :17 import fs from "node:fs";
fs package/src/core/update-check.js :6 import fs from "node:fs";
fs package/src/core/vars/sources.js :16 import fs from "node:fs";
fs package/src/core/voice/audio-decode.js :9 import fs from "node:fs";
fs package/src/core/voice/engines/elevenlabs.js :14 import fs from "node:fs";
fs package/src/core/voice/engines/gemini.js :20 import fs from "node:fs";
fs package/src/core/voice/engines/mock.js :9 import fs from "node:fs";
fs package/src/core/voice/engines/openai.js :15 import fs from "node:fs";
fs package/src/core/voice/engines/piper.js :16 import fs from "node:fs";
fs package/src/core/voice/stt-models.js :10 import fs from "node:fs";
fs package/src/core/voice/transcription.js :18 import fs from "node:fs";
fs package/src/core/voice/tts.js :10 import fs from "node:fs";
fs package/src/host/daemon/api/admin.js :8 import fs from "node:fs";
fs package/src/host/daemon/api/agents.js :7 import fs from "node:fs";
fs package/src/host/daemon/api/artifacts.js :7 import fs from "node:fs";
fs package/src/host/daemon/api/config.js :6 import fs from "node:fs";
fs package/src/host/daemon/api/mcps.js :10 import fs from "node:fs";
fs package/src/host/daemon/api/runtimes.js :8 import fs from "node:fs";
fs package/src/host/daemon/api/sessions.js :5 import fs from "node:fs";
fs package/src/host/daemon/api/shared.js :5 import fs from "node:fs";
fs package/src/host/daemon/api/skills.js :21 import fs from "node:fs";
fs package/src/host/daemon/api/top-level.js :11 import fs from "node:fs";
fs package/src/host/daemon/api/voice.js :21 import fs from "node:fs";
fs package/src/host/daemon/api/web.js :11 import fs from "node:fs";
fs package/src/host/daemon/db.js :3 import fs from "node:fs";
fs package/src/host/daemon/index.js :5 import fs from "node:fs";
fs package/src/host/daemon/project-config.js :25 import fs from "node:fs";
fs package/src/host/daemon/runtimes/antigravity.js :22 import fs from "node:fs";
fs package/src/host/daemon/runtimes/claude-code.js :6 import fs from "node:fs";
fs package/src/host/daemon/smoke.js :8 import fs from "node:fs";
fs package/src/host/daemon/stt-venv.js :10 import fs from "node:fs";
fs package/src/host/daemon/token-store.js :23 import fs from "node:fs";
fs package/src/interfaces/acp/index.js :22 import fs from "node:fs";
fs package/src/interfaces/cli/claude-permissions.js :1 import fs from "node:fs";
fs package/src/interfaces/cli/commands/agent.js :1 import fs from "node:fs";
fs package/src/interfaces/cli/commands/artifact.js :1 import fs from "node:fs";
fs package/src/interfaces/cli/commands/code.js :4 import { existsSync } from "node:fs";
fs package/src/interfaces/cli/commands/command.js :2 import fs from "node:fs";
fs package/src/interfaces/cli/commands/daemon.js :1 import fs from "node:fs";
fs package/src/interfaces/cli/commands/desktop.js :2 import fs from "node:fs";
fs package/src/interfaces/cli/commands/log.js :12 import fs from "node:fs";
fs package/src/interfaces/cli/commands/memory.js :1 import fs from "node:fs";
fs package/src/interfaces/cli/commands/project-config.js :12 import fs from "node:fs";
fs package/src/interfaces/cli/commands/routine.js :1 import fs from "node:fs";
fs package/src/interfaces/cli/commands/session.js :1 import fs from "node:fs";
fs package/src/interfaces/cli/commands/sessions.js :5 import fs from "node:fs";
fs package/src/interfaces/cli/commands/setup.js :5 import fs from "node:fs";
fs package/src/interfaces/cli/commands/skills.js :2 import fs from "node:fs";
fs package/src/interfaces/cli/commands/voice.js :12 import fs from "node:fs";
fs package/src/interfaces/cli/http.js :2 import fs from "node:fs";
fs package/src/interfaces/cli/index.js :4 import fs from "node:fs";
fs package/src/interfaces/desktop/main.js :15 const fs = require("fs");
fs package/src/interfaces/tui/_shims/util-filesystem.ts :1 import fs from "node:fs"
fs package/src/interfaces/tui/_shims/util-which.ts :9 import fs from "node:fs"
fs package/src/interfaces/tui/component/prompt/frecency.tsx :7 import { appendFile, writeFile } from "fs/promises"
fs package/src/interfaces/tui/component/prompt/history.tsx :7 import { appendFile, writeFile } from "fs/promises"
fs package/src/interfaces/tui/component/prompt/stash.tsx :7 import { appendFile, writeFile } from "fs/promises"
fs package/src/interfaces/tui/context/editor.ts :1 import { readdirSync, readFileSync, statSync } from "node:fs"
fs package/src/interfaces/tui/context/kv.tsx :1 import { rename, readFile, writeFile, rm, mkdir } from "fs/promises"
fs package/src/interfaces/tui/context/sdk-apx.tsx :4 import fs from "node:fs"
fs package/src/interfaces/tui/util/clipboard.ts :4 import fs from "fs/promises"
fs package/src/interfaces/tui/util/editor.ts :2 import { rm } from "node:fs/promises"

shell / exec 33

shell package/src/core/agent/tools/handlers/_git.js :4 import { spawn } from "node:child_process";
shell package/src/core/agent/tools/handlers/run-shell.js :1 import { spawn } from "node:child_process";
shell package/src/core/agent/tools/handlers/search-files.js :1 import { execFile } from "node:child_process";
shell package/src/core/artifacts/tunnel.js :13 import { spawn, spawnSync } from "node:child_process";
shell package/src/core/desktop/autostart.js :19 import { execFileSync } from "node:child_process";
shell package/src/core/desktop/process.js :13 import { spawn, execFileSync } from "node:child_process";
shell package/src/core/git-baseline.js :11 import { execFileSync } from "node:child_process";
shell package/src/core/http-tools/glob.js :24 return new RegExp(`^${re}$`);
shell package/src/core/http-tools/grep.js :9 import { execFile } from "node:child_process";
shell package/src/core/mcp/runner.js :8 import { spawn } from "node:child_process";
shell package/src/core/routines/runner.js :12 import { spawn } from "node:child_process";
shell package/src/core/stores/messages.js :598 // exec (telegram, web quick-chat, desktop, deck …). A "thread" is one
shell package/src/core/voice/engines/piper.js :18 import { spawn, execFile } from "node:child_process";
shell package/src/core/voice/stt-hardware.js :15 import { spawnSync } from "node:child_process";
shell package/src/host/daemon/api/admin.js :7 import { execFile } from "node:child_process";
shell package/src/host/daemon/api/artifacts.js :8 import { spawn } from "node:child_process";
shell package/src/host/daemon/api/run.js :5 import { execFile } from "node:child_process";
shell package/src/host/daemon/api/skills.js :24 import { spawnSync } from "node:child_process";
shell package/src/host/daemon/deck-exec.js :10 import { spawn } from "node:child_process";
shell package/src/host/daemon/runtimes/_spawn.js :3 import { spawn } from "node:child_process";
shell package/src/host/daemon/stt-venv.js :11 import { spawn } from "node:child_process";
shell package/src/host/daemon/whisper-server.js :11 import { spawn, exec } from "node:child_process";
shell package/src/interfaces/cli/commands/artifact.js :2 import { spawn } from "node:child_process";
shell package/src/interfaces/cli/commands/code.js :7 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/desktop.js :5 import { spawn, execFileSync } from "node:child_process";
shell package/src/interfaces/cli/commands/project-config.js :15 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/session.js :3 import { spawn } from "node:child_process";
shell package/src/interfaces/cli/commands/setup.js :9 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/update.js :1 import { spawnSync } from "node:child_process";
shell package/src/interfaces/cli/commands/voice.js :15 import { spawn, spawnSync, execFileSync } from "node:child_process";
shell package/src/interfaces/cli/http.js :5 import { spawn } from "node:child_process";
shell package/src/interfaces/tui/_shims/util-process.ts :1 import { exec, spawn as nodeSpawn } from "node:child_process"
shell package/src/interfaces/tui/context/sdk-apx.tsx :7 import { spawn, execSync } from "node:child_process"

network 32

net package/src/core/agent/tools/registry-bridge.js :96 res = await fetch(url, opts);
net package/src/core/artifacts/preview.js :18 import http from "node:http";
net package/src/core/channels/telegram/api.js :18 const res = await fetch(`${API_BASE}/bot${token}/${method}`, {
net package/src/core/channels/telegram/media.js :41 const res = await fetch(url, { method: "POST", body: form });
net package/src/core/engines/_health.js :14 fetch(url, { signal: ctrl.signal, headers }),
net package/src/core/engines/anthropic.js :63 const res = await fetch(API_BASE, {
net package/src/core/engines/gemini.js :134 const res = await fetch(url, {
net package/src/core/engines/ollama.js :96 const res = await fetch(url, {
net package/src/core/engines/openai-compatible.js :113 const res = await fetch(`${getBaseUrl(config)}/chat/completions`, {
net package/src/core/http-tools/fetch.js :19 import net from "node:net";
net package/src/core/http-tools/registry.js :293 // ── fetch (native HTTP, no browser) ───────────────────────────────────────
net package/src/core/http-tools/search.js :34 return fetch(url, opts);
net package/src/core/integrations/plugins/asana.js :46 res = await fetch(url, {
net package/src/core/integrations/plugins/github.js :32 res = await fetch(url, {
net package/src/core/mcp/runner.js :324 res = await fetch(this.url, {
net package/src/core/memory/embed-engines/gemini.js :35 const res = await fetch(
net package/src/core/memory/embed-engines/ollama.js :37 const res = await fetch(`${base}/api/embeddings`, {
net package/src/core/memory/embed-engines/openai.js :43 const res = await fetch(`${base}/embeddings`, {
net package/src/core/net/ipv4-first.js :16 import net from "node:net";
net package/src/core/update-check.js :8 import https from "node:https";
net package/src/core/voice/engines/elevenlabs.js :65 const res = await fetch(url, {
net package/src/core/voice/engines/gemini.js :69 const res = await fetch(url, {
net package/src/core/voice/engines/openai.js :95 const res = await fetch(url, {
net package/src/core/voice/transcription.js :209 const res = await fetch(`http://127.0.0.1:${WHISPER_LOCAL_PORT}/transcribe`, {
net package/src/host/daemon/wakeup.js :2 import fetch from "node-fetch";
net package/src/host/daemon/whisper-server.js :35 const res = await fetch(`http://127.0.0.1:${WHISPER_LOCAL_PORT}/health`, {
net package/src/interfaces/acp/session.js :27 const res = await fetch(`${baseUrl}${p}`, {
net package/src/interfaces/cli/commands/setup.js :6 import https from "node:https";
net package/src/interfaces/cli/http.js :28 const res = await fetch(`${baseUrl()}/health`, { signal: ctrl.signal });
net package/src/interfaces/desktop/main.js :16 const http = require("http");
net package/src/interfaces/tui/component/dialog-workspace-create.tsx :65 .fetch(url)
net package/src/interfaces/tui/context/sdk-apx.tsx :106 const res = await fetch(`${props.url}/projects/${props.pid}/super-agent/chat/stream`, {

secrets 11

secrets package/src/core/agent/tools/registry-bridge.js :34 process.env.APX_TOKEN ||
secrets package/src/core/channels/telegram/helpers.js :96 process.env.BOT_TELEGRAM_TOKEN ||
secrets package/src/core/engines/anthropic.js :9 return config.api_key || process.env.ANTHROPIC_API_KEY || "";
secrets package/src/core/engines/gemini.js :9 return config.api_key || process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || "";
secrets package/src/core/http-tools/search.js :158 const apiKey = process.env.BRAVE_API_KEY;
secrets package/src/core/memory/embed-engines/gemini.js :13 process.env.GEMINI_API_KEY ||
secrets package/src/core/memory/embed-engines/openai.js :15 process.env.OPENAI_API_KEY ||
secrets package/src/core/voice/engines/elevenlabs.js :26 return config.api_key || process.env.ELEVENLABS_API_KEY || "";
secrets package/src/core/voice/engines/gemini.js :30 process.env.GEMINI_API_KEY ||
secrets package/src/core/voice/engines/openai.js :30 process.env.OPENAI_API_KEY ||
secrets package/src/core/voice/transcription.js :132 openai.api_key = t.openai?.api_key || cfg.engines?.openai?.api_key || process.env.OPENAI_API_KEY || "";

install hooks 3

prepare package/package.json :41 node scripts/install-githooks.js
prepack package/package.json :42 node scripts/sync-apc-skill.js && node scripts/build-web.js
postinstall package/package.json :43 node src/interfaces/cli/postinstall.js

declared dependencies 36

@modelcontextprotocol/sdk@^1.29.0
@opentui/core@^0.2.16
@opentui/keymap@^0.2.16
@opentui/solid@^0.2.16
@solid-primitives/event-bus@^1.1.3
@solid-primitives/scheduled@^1.5.2
chalk@^5.6.2
cli-cursor@^5.0.0
cli-sound@^1.1.3
clipboardy@^4.0.0
cron-parser@^5.5.0
effect@^3.21.2
esbuild-plugin-solid@^0.6.0
express@^4.21.0
fuzzysort@^3.1.0
iconv-lite@^0.6.3
node-fetch@^3.3.2
open@^10.1.2
opentui-spinner@^0.0.6
qrcode-terminal@^0.12.0
raw-body@^3.0.0
react@^19.2.0
remeda@^2.21.0
safer-buffer@^2.1.2
solid-js@^1.9.13
@semantic-release/changelog@^6.0.3
@semantic-release/git@^10.0.1
@types/node@^25.7.0
conventional-changelog-conventionalcommits@^9.3.1
electron@^33.4.11
esbuild@^0.28.0
typescript@^6.0.3
better-sqlite3@^11.3.0
fast-glob@^3.3.2
puppeteer@^22.0.0
sqlite-vec@^0.1.6

clipboard 2

clipboard shell call package/src/host/daemon/deck-exec.js :49 /** Pipe `text` into the platform clipboard (pbcopy / xclip / clip). */
clipboard shell call package/src/interfaces/tui/util/clipboard.ts :106 const wayland = await Process.run(["wl-paste", "-t", "image/png"], { nothrow: true })