Is agnix safe?

The code builds an OS command out of values that can change at runtime, then runs it through a shell.

execSync(
      `powershell -Command "Expand-Archive -Path '${archivePath}' -DestinationPath '${destDir}' -Force"`,

execSync(`tar -xzf "${archivePath}" -C "${destDir}"`, { stdio: 'inherit' });

Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.

Fix: Use execFile/spawn with an argument array instead of exec; never build a shell command string from external input.

package.json runs scripts automatically when the package is installed.

"postinstall": "node install.js",

Why it matters: Install scripts are a favorite supply-chain foothold — they execute on every machine that installs the package.

Fix: Inspect the hook command. Install-time scripts are a common supply chain execution vector; ensure they do nothing beyond a documented build step.

The component can run operating-system commands or spawn processes.

const { spawn, spawnSync } = require('child_process');

const result = spawnSync(binaryPath, args, {

const child = spawn(binaryPath, args, options);

const { execSync, spawnSync } = require('child_process');

execSync(

execSync(`tar -xzf "${archivePath}" -C "${destDir}"`, { stdio: 'inherit' });

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component reads files from disk.

const stream = fs.createReadStream(filePath);

const raw = fs.readFileSync(checksumPath, 'utf8').trim();

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

fs.unlinkSync(filePath);

file = fs.createWriteStream(destPath);

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component makes outbound network requests.

const https = require('https');

const request = https.get(url, (response) => {

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.