registry / Credential exfiltration / @chozzz/vargos
@chozzz/vargos
Self-hosted agent OS with persistent memory, multi-channel presence, tools, scheduling, and sub-agent orchestration
This report shows the evidence for @chozzz/vargos@3.2.16. 4 of 6 known versions are blocked or flagged. The newest version, 3.2.20, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a concrete credential-harvesting payload automatically deployed into an auto-loaded agent skill path. The benign native-module rebuild postinstall hook does not neutralize the runtime credential-capture chain.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running Vargos so its boot sequence seeds the agent directory, followed by execution of the installed token-capture skill.
Impact
A Claude bearer token can be extracted from the user's authenticated CLI session and exposed to the agent or command output.
Mechanism
MITM interception of Claude Authorization headers through a TLS-disabled local proxy.
Attack narrative
The package carries a credential-capture skill as a normal bundled agent template. At runtime it seeds that template into the agent skills directory, which the agent framework auto-loads. The skill starts mitmproxy, turns off Node TLS verification, routes Claude CLI traffic through the proxy, reads the Authorization header for /v1/messages, and prints the bearer token. This creates an installed agent capability to harvest a user's Claude credential.
AI rationale
This is a concrete credential-harvesting payload automatically deployed into an auto-loaded agent skill path. The benign native-module rebuild postinstall hook does not neutralize the runtime credential-capture chain.
Evidence
dist/.templates/agent/skills/token-capture/SKILL.mddist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shdist/lib/templates.jsdist/services/agent/skills.js~/.vargos/agent/skills/token-capture/
Network endpoints1
127.0.0.1:$PORT
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- A bundled agent skill explicitly captures a Claude bearer token.
- Its script runs a local MITM proxy, disables TLS verification, and redirects Claude traffic through it.
- The token-capture skill is copied into the package-owned agent directory automatically when Vargos boots.
- The copied skill is in an auto-loaded agent skills location, enabling credential-capture capability during normal runtime.
Evidence against
- The npm postinstall hook only rebuilds better-sqlite3 and does not deploy this payload.
- The script does not send the captured token to a remote host; it prints it locally.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = pnpm rebuild better-sqlite3
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = pnpm rebuild better-sqlite3
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/core/edges.jsView file
37continue;
L38: const mod = await import(modulePath);
L39: const priority = mod.BOOT_PRIORITY ?? DEFAULT_BOOT_PRIORITY;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core/edges.jsView on unpkg · L37dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView file
•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh
kind = payload_in_excluded_dir
sizeBytes = 3223
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkg•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh
kind = build_helper
sizeBytes = 3223
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkgdist/lib/migrate.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 11
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/lib/migrate.jsView on unpkgdist/edge/web/index.jsView file
•matchType = normalized_sha256
matchedPackage = @chozzz/vargos@3.2.15
matchedPath = dist/edge/web/index.js
matchedIdentity = npm:QGNob3p6ei92YXJnb3M:3.2.15
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/edge/web/index.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @chozzz/vargos@3.2.7
matchedIdentity = npm:QGNob3p6ei92YXJnb3M:3.2.7
similarity = 0.422
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/edge/web/index.jsView on unpkgdist/cli/chat.jsView file
•matchType = normalized_sha256
matchedPackage = @chozzz/vargos@3.2.15
matchedPath = dist/cli/chat.js
matchedIdentity = npm:QGNob3p6ei92YXJnb3M:3.2.15
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/chat.jsView on unpkgdist/cli/enrich.jsView file
•matchType = normalized_sha256
matchedPackage = @chozzz/vargos@3.2.15
matchedPath = dist/cli/enrich.js
matchedIdentity = npm:QGNob3p6ei92YXJnb3M:3.2.15
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/enrich.jsView on unpkgFindings
7 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirdist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh
HighSemantic Analysis Limiteddist/lib/migrate.js
HighKnown Malware Source Similaritydist/edge/web/index.js
HighKnown Malware Source Similaritydist/cli/chat.js
HighKnown Malware Source Similaritydist/cli/enrich.js
HighPrevious Version Dangerous Deltadist/edge/web/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/core/edges.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @chozzz/vargos@3.2.16.
The versions list below shows the verdict for each recorded version.
- Avoid installing @chozzz/vargos@3.2.16. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
6 known versions3.2.20latestSuspiciousCredential ExfiltrationWarnPublishedSep 16, 2026, 6:30 AM3.2.16shownMaliciousCredential ExfiltrationBlockPublishedSep 11, 2026, 2:56 AM3.2.15MaliciousCredential ExfiltrationBlockPublishedSep 3, 2026, 1:33 PM3.2.13MaliciousCredential ExfiltrationBlockPublishedAug 18, 2026, 4:40 AM3.2.8MaliciousCredential ExfiltrationBlockPublishedJul 18, 2026, 3:21 AM3.2.7Suspicious—WarnPublishedJul 18, 2026, 1:16 AM