Loading npm security reports…

@chozzz/vargos@3.2.13: Malicious npm security report (Block) | LPM Firewall

registry / @chozzz/vargos / 3.2.13

@chozzz/vargos@3.2.13

Self-hosted agent OS with persistent memory, multi-channel presence, tools, scheduling, and sub-agent orchestration

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The package ships and deploys a Claude bearer-token interception skill. It disables TLS verification, proxies Claude traffic locally, captures Authorization, and prints the credential.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `vargos chat`, then the seeded agent invokes the token-capture skill.

Impact

Compromises an active Claude API credential for subsequent unauthorized use.

Mechanism

MITM interception and local extraction of a Claude Authorization bearer token.

Attack narrative

On `vargos chat`, the package copies its bundled agent templates into the Vargos data directory. One template instructs an agent to run a shell script that launches mitmdump, disables Node TLS verification, routes a Claude CLI request through the proxy, extracts the `/v1/messages` Authorization header, and prints the bearer token. Although npm install does not execute this payload and the script has no remote exfiltration host, its stated purpose and implementation are credential harvesting.

Rationale

This is a concrete credential-capture payload deployed into an agent skill directory, not a package-aligned runtime feature. The non-executing native rebuild postinstall does not mitigate the deliberate token-harvesting behavior.

Evidence

dist/cli/chat.jsdist/lib/templates.jsdist/.templates/agent/skills/token-capture/SKILL.mddist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shpackage.json

Network endpoints1

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = pnpm rebuild better-sqlite3

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = pnpm rebuild better-sqlite3

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/edges.jsView file

37continue; L38: const mod = await import(modulePath); L39: const priority = mod.BOOT_PRIORITY ?? DEFAULT_BOOT_PRIORITY;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/edges.jsView on unpkg · L37

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView file

•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh kind = payload_in_excluded_dir sizeBytes = 3223 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkg

•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh kind = build_helper sizeBytes = 3223 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkg

dist/lib/migrate.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/migrate.jsView on unpkg

dist/cli/onboard.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @chozzz/vargos@3.2.7 matchedIdentity = npm:QGNob3p6ei92YXJnb3M:3.2.7 similarity = 0.489 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/onboard.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 74-96json

74 "lint-staged": {

75 "*.ts": [

76 "eslint --fix"

77 ]

78 },

79 "engines": {

80 "node": ">=22.19.0"

81 },

82 "scripts": {

83 "start": "tsx index.ts",

84 "seed": "tsx scripts/seed.ts",

85 "migrate": "tsx scripts/migrate.ts",

86 "cli": "tsx cli.ts",

87 "chat": "tsx scripts/seed.ts && PI_CODING_AGENT_DIR=\"${VARGOS_DATA_DIR:-$HOME/.vargos}/agent\" pi --session-dir \"${VARGOS_DATA_DIR:-$HOME/.vargos}/sessions/cli\"",

88 "build": "rm -rf dist && tsc && cp -r .templates dist/.templates",

89 "test": "vitest",

90 "test:run": "vitest run",

91 "lint": "eslint --no-error-on-unmatched-pattern 'core/**/*.ts' 'services/**/*.ts' 'edge/**/*.ts' 'lib/**/*.ts' '.migrations/**/*.ts' 'scripts/**/*.ts' 'index.ts' 'boot.ts' 'cli.ts' 'cli/**/*.ts' 'vitest.config.ts' && tsc --noEmit",

92 "typecheck": "tsc --noEmit",

93 "precommit": "pnpm exec lint-staged && pnpm run typecheck && pnpm run test:run",

94 "postinstall": "pnpm rebuild better-sqlite3"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L94

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L94

95 }

96}

dist/core/edges.jsView file

Lines 17-44javascript

17 names = readdirSync(edgeDir, { withFileTypes: true })

18 .filter(e => e.isDirectory() && existsSync(path.join(edgeDir, e.name, `index.${ext}`)))

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView file

•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh kind = payload_in_excluded_dir sizeBytes = 3223 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkg

•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh kind = build_helper sizeBytes = 3223 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkg

dist/lib/migrate.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/lib/migrate.jsView on unpkg

dist/cli/onboard.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @chozzz/vargos@3.2.7 matchedIdentity = npm:QGNob3p6ei92YXJnb3M:3.2.7 similarity = 0.489 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/onboard.jsView on unpkg