registry / @guangnao/agent-hub / 1.0.8

@guangnao/agent-hub@1.0.8

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an explicit user-run hub/node proxy for pooling local Claude/Codex subscriptions, with credential access and network forwarding aligned with its stated purpose.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit CLI commands such as agent-hub start, serve, node, state, or programmatic createHub/startNode calls.

Impact

Can expose or spend local subscription capacity if the user runs it with weak hub/API/node-token configuration; no install-time unconsented mutation or exfiltration found.

Mechanism

User-invoked LLM hub/proxy and worker-node forwarding

Rationale

The high-risk primitives are real but are activated by explicit user commands and match the package's documented hub/proxy function. There is no npm install-time execution, hardcoded attacker endpoint, stealth persistence, credential exfiltration beyond official/user-configured provider use, or unconsented AI-agent control-surface mutation.

Evidence

package.jsonsrc/cli.tssrc/config.tssrc/node.tssrc/hub.tssrc/protocol.tsdist/index.jsREADME.md~/.agent-hub/config.json$TMPDIR/agent-hub/config.json~/.claude/.credentials.json~/.codex/auth.json

Network endpoints4

console.anthropic.com/v1/oauth/tokenapi.anthropic.comauth.openai.com/oauth/tokenchatgpt.com/backend-api/codex

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/index.js bundles credential-reading proxy code for Claude/Codex and sends authenticated requests to provider APIs.
src/cli.ts start command auto-installs pm2 with npm when pm2 is absent, but only after explicit agent-hub start.
src/node.ts connects to a user-supplied hub URL and accepts jobs that consume local Claude/Codex subscriptions.

Evidence against

package.json has no preinstall/install/postinstall hook; only prepublishOnly for publisher-side checks.
src/cli.ts exposes explicit commands; import of src/index.ts only exports createHub/startNode and does not start network or shell actions.
src/config.ts writes only package-owned API key config/lock files for the hub, not foreign agent configuration.
README.md documents credential use, hub/node topology, pm2 install behavior, and security risks.
src/hub.ts authenticates /v1 when apiKey is configured and warns if exposed without API/node tokens.
No hardcoded attacker endpoint found; provider endpoints are Anthropic/OpenAI or user-configurable base URLs.

Behavioral surface

Source

Source & flagged code

7 flagged

dist/index.jsView file

45L46: `)}function fe(){let e={text:"",thinking:"",usage:jr(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L47: `}let u=ln(n.maxConcurrency,!!n.claudeToken),c=await u.acquire();try{await xt({bin:n.claudeBin,args:s,prompt:i,cwd:c.workDir,env:{...process.env,HOME:c.home,CLAUDE_CONFIG_DIR:c.con...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L45

42# TYPE agent_p2p_jobs_by_provider_total counter L43: ${U}`+Pr("agent_p2p_ttfb_ms",_.ttfb)+Pr("agent_p2p_duration_ms",_.dur));return}if(w==="/state"&&f.method==="GET"){let _=Date.now(),v=[...a.values()].map(k=>({id:k.id.slice(0,8),nam... L44: `)}var H={info:(e,t)=>nn(process.stdout,"info",e,t),warn:(e,t)=>nn(process.stderr,"warn",e,t),error:(e,t)=>nn(process.stderr,"error",e,t)};var gt=class{constructor(t,n){this.max=t;... L45: L46: `)}function fe(){let e={text:"",thinking:"",usage:jr(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L47: `}let u=ln(n.maxConcurrency,!!n.claudeToken),c=await u.acquire();try{await xt({bin:n.claudeBin,args:s,prompt:i,cwd:c.workDir,env:{...process.env,HOME:c.home,CLAUDE_CONFI

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L42

1import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L2: var _s=Object.create;var xn=Object.defineProperty;var ys=Object.getOwnPropertyDescriptor;var xs=Object.getOwnPropertyNames;var bs=Object.getPrototypeOf,ws=Object.prototype.hasOwnPr... L3: `).join(`\r ... L19: ${e}_count ${t.count} L20: `},Xt=()=>({dispatched:0,served:0,failed:0,rateLimited:0}),hi=16*1024*1024,mi=e=>new Promise((t,n)=>{let r=[],s=0;e.on("data",o=>{if(s+=o.length,s>hi){e.destroy(),n(new Error("body... L21: `)),n=(f,b,w)=>{let x=new Date().toISOString();if(e.logJson)return JSON.stringify({ts:x,level:f,msg:b,...w});let _=w?" "+Object.entries(w).map(([v,k])=>`${v}=${typeof k=="string"?k... ... L45: L46: `)}function fe(){let e={text:"",thinking:"",usage:jr(),stop:"stop"};return{s

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L45

dist/cli.jsView file

2import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var Ls=Object.create;var Tn=Object.defineProperty;var Ds=Object.getOwnPropertyDescriptor;var $s=Object.getOwnPropertyNames;var js=Object.getPrototypeOf,Fs=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}function ke(e,t,n,r,s,o){if(e.listenerCount("wsClientError")){let i=new Error(s);Error.captureStackTrace(i,ke),e.emit("wsClientError",i,n,t)}else Je(n,r,s,o)}});import{spawnSy... L10: data: ${JSON.stringify({type:"error",error:{type:"api_error",message:n}})}

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L2

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> dist/cli.js L2: import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var Ls=Object.create;var Tn=Object.defineProperty;var Ds=Object.getOwnPropertyDescriptor;var $s=Object.getOwnPropertyNames;var js=Object.getPrototypeOf,Fs=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}function ke(e,t,n,r,s,o){if(e.listenerCount("wsClientError")){let i=new Error(s);Error.captureStackTrace(i,ke),e.emit("wsClientError",i,n,t)}else Je(n,r,s,o)}});import{spawnSy... L10: data: ${JSON.stringify({type:"error",error:{type:"api_error",message:n}})} ... L20: ${e}_count ${t.count} L21: `},tn=()=>({dispatched:0,served:0,failed:0,rateLimited:0}),Ii=16*1024*1024,Bi=e=>new Promise((t,n)=>{let r=[],s=0;e.on("data",o=>{if

Source & flagged code

7 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L45

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L42

Findings

3 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Low