registry / @guangnao/agent-hub / 1.0.6

@guangnao/agent-hub@1.0.6

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked hub/node proxy for pooling Claude/Codex subscription-backed local agents, with documented network service behavior and package-owned config writes.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI commands such as agent-hub start, serve, node, state, or new apikey

Impact

Can expose subscription-backed model access if the operator runs it without API keys or firewalling, but this is documented operational risk rather than covert malware.

Mechanism

User-invoked LLM proxy hub and worker-node forwarding

Rationale

Static source inspection shows network, credential-adjacent, and pm2/npm primitives are aligned with the documented CLI proxy product and require explicit user commands. There is no install-time execution, hardcoded exfiltration endpoint, credential harvesting payload, or unconsented mutation of a broad AI-agent control surface.

Evidence

package.jsonsrc/cli.tssrc/config.tssrc/node.tssrc/hub.tssrc/index.tsREADME.mdAGENT_HUB_CONFIG~/.agent-hub/config.json$TMPDIR/agent-hub/config.json

Network endpoints4

127.0.0.1:8790127.0.0.1:<dynamic-local-port>0.0.0.0:8790<user-supplied hubUrl>/ws

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

src/cli.ts user-invoked start can run npm i -g pm2 if pm2 is missing
src/config.ts writes generated API keys to AGENT_HUB_CONFIG, ~/.agent-hub/config.json, or tmp config
src/node.ts connects to user-supplied hubUrl and forwards local LLM proxy responses over WebSocket

Evidence against

package.json has no install/preinstall/postinstall hooks; only prepublishOnly for maintainer publishing
src/cli.ts dangerous operations are explicit CLI subcommands, not install-time or import-time execution
src/node.ts starts a localhost proxy and forwards request results, not raw credential files or environment dumps
src/hub.ts exposes documented /v1 proxy, /ws node registration, /health, /state, and /metrics behavior
src/config.ts stores package-owned API key config only; no foreign AI-agent config mutation found
No hardcoded external exfiltration endpoint found; hub URL is supplied by user/env

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Source & flagged code

8 flagged

dist/index.jsView file

45L46: `)}function fe(){let e={text:"",thinking:"",usage:jr(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L47: `}let u=ln(n.maxConcurrency,!!n.claudeToken),c=await u.acquire();try{await xt({bin:n.claudeBin,args:s,prompt:i,cwd:c.workDir,env:{...process.env,HOME:c.home,CLAUDE_CONFIG_DIR:c.con...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L45

42# TYPE agent_p2p_jobs_by_provider_total counter L43: ${U}`+Pr("agent_p2p_ttfb_ms",_.ttfb)+Pr("agent_p2p_duration_ms",_.dur));return}if(w==="/state"&&f.method==="GET"){let _=Date.now(),v=[...a.values()].map(k=>({id:k.id.slice(0,8),nam... L44: `)}var H={info:(e,t)=>nn(process.stdout,"info",e,t),warn:(e,t)=>nn(process.stderr,"warn",e,t),error:(e,t)=>nn(process.stderr,"error",e,t)};var gt=class{constructor(t,n){this.max=t;... L45: L46: `)}function fe(){let e={text:"",thinking:"",usage:jr(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L47: `}let u=ln(n.maxConcurrency,!!n.claudeToken),c=await u.acquire();try{await xt({bin:n.claudeBin,args:s,prompt:i,cwd:c.workDir,env:{...process.env,HOME:c.home,CLAUDE_CONFI

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L42

1import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L2: var _s=Object.create;var xn=Object.defineProperty;var ys=Object.getOwnPropertyDescriptor;var xs=Object.getOwnPropertyNames;var bs=Object.getPrototypeOf,ws=Object.prototype.hasOwnPr... L3: `).join(`\r ... L19: ${e}_count ${t.count} L20: `},Xt=()=>({dispatched:0,served:0,failed:0,rateLimited:0}),hi=16*1024*1024,mi=e=>new Promise((t,n)=>{let r=[],s=0;e.on("data",o=>{if(s+=o.length,s>hi){e.destroy(),n(new Error("body... L21: `)),n=(f,b,w)=>{let x=new Date().toISOString();if(e.logJson)return JSON.stringify({ts:x,level:f,msg:b,...w});let _=w?" "+Object.entries(w).map(([v,k])=>`${v}=${typeof k=="string"?k... ... L45: L46: `)}function fe(){let e={text:"",thinking:"",usage:jr(),stop:"stop"};return{s

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L45

dist/cli.jsView file

2import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var Ls=Object.create;var Tn=Object.defineProperty;var Ds=Object.getOwnPropertyDescriptor;var $s=Object.getOwnPropertyNames;var js=Object.getPrototypeOf,Fs=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}function ke(e,t,n,r,s,o){if(e.listenerCount("wsClientError")){let i=new Error(s);Error.captureStackTrace(i,ke),e.emit("wsClientError",i,n,t)}else Je(n,r,s,o)}});import{spawnSy... L10: data: ${JSON.stringify({type:"error",error:{type:"api_error",message:n}})}

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L2

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> dist/cli.js L2: import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var Ls=Object.create;var Tn=Object.defineProperty;var Ds=Object.getOwnPropertyDescriptor;var $s=Object.getOwnPropertyNames;var js=Object.getPrototypeOf,Fs=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}function ke(e,t,n,r,s,o){if(e.listenerCount("wsClientError")){let i=new Error(s);Error.captureStackTrace(i,ke),e.emit("wsClientError",i,n,t)}else Je(n,r,s,o)}});import{spawnSy... L10: data: ${JSON.stringify({type:"error",error:{type:"api_error",message:n}})} ... L20: ${e}_count ${t.count} L21: `},tn=()=>({dispatched:0,served:0,failed:0,rateLimited:0}),Ii=16*1024*1024,Bi=e=>new Promise((t,n)=>{let r=[],s=0;e.on("data",o=>{if

Source & flagged code

8 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L45

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L42

Findings

4 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Low