registry / @guangnao/agent-hub / 1.1.0

@guangnao/agent-hub@1.1.0

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an explicit hub/worker proxy for Claude/Codex subscriptions, with credential access and network forwarding tied to user-run serve/node/start commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs agent-hub start, serve, node, state, delete, or imports createHub/startNode.

Impact

Can consume configured Claude/Codex/OpenAI subscription capacity and expose a hub if deployed without API keys, as documented.

Mechanism

User-invoked AI provider proxy and worker hub.

Rationale

Static inspection shows high-risk primitives are package-aligned and activated by explicit user commands, not npm install/import-time behavior. No concrete malicious exfiltration, unauthorized control-surface mutation, or stealth persistence was found.

Evidence

package.jsonsrc/cli.tssrc/node.tssrc/hub.tssrc/config.tsREADME.mddist/index.jsdist/cli.js~/.agent-hub/config.json$TMPDIR/agent-hub/config.json~/.claude/.credentials.json~/.claude.json~/.codex/auth.jsontemporary agent-llm work directories

Network endpoints5

console.anthropic.com/v1/oauth/tokenapi.anthropic.comauth.openai.com/oauth/tokenchatgpt.com/backend-api/codex

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist bundles @guangnao/agent-llm code that reads ~/.claude credentials and ~/.codex/auth.json for user-invoked proxying.
src/cli.ts start command can run npm i -g pm2, but only when user runs agent-hub start and pm2 is missing.
src/config.ts writes ~/.agent-hub/config.json or tmp fallback to persist hub API keys.

Evidence against

package.json has no preinstall/install/postinstall hooks; only prepublishOnly for publisher-side build/test.
src/node.ts connects only to user-supplied hubUrl and forwards jobs to a local 127.0.0.1 proxy.
src/hub.ts exposes intended /v1 proxy endpoints and dispatches requests to registered worker nodes.
README.md explicitly documents credential sources, pm2 install behavior, hub/node topology, and security risks.
Provider endpoints in dist are Anthropic/OpenAI/Codex-aligned: console.anthropic.com, api.anthropic.com, auth.openai.com, chatgpt.com.
No hidden exfiltration endpoint, destructive action, persistence beyond explicit pm2/config use, or install-time AI-agent control mutation found.

Behavioral surface

Source

Source & flagged code

7 flagged

dist/index.jsView file

45L46: `)}function pe(){let e={text:"",thinking:"",usage:Fr(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L47: `}let u=fn(n.maxConcurrency,!!n.claudeToken),c=await u.acquire();try{await kt({bin:n.claudeBin,args:s,prompt:i,cwd:c.workDir,env:{...process.env,HOME:c.home,CLAUDE_CONFIG_DIR:c.con...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L45

42# TYPE agent_p2p_jobs_by_provider_total counter L43: ${U}`+Ar("agent_p2p_ttfb_ms",m.ttfb)+Ar("agent_p2p_duration_ms",m.dur));return}if(S==="/state"&&f.method==="GET"){let m=Date.now(),k=[...a.values()].map(w=>({id:w.id.slice(0,8),nam... L44: `)}var H={info:(e,t)=>on(process.stdout,"info",e,t),warn:(e,t)=>on(process.stderr,"warn",e,t),error:(e,t)=>on(process.stderr,"error",e,t)};var bt=class{constructor(t,n){this.max=t;... L45: L46: `)}function pe(){let e={text:"",thinking:"",usage:Fr(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L47: `}let u=fn(n.maxConcurrency,!!n.claudeToken),c=await u.acquire();try{await kt({bin:n.claudeBin,args:s,prompt:i,cwd:c.workDir,env:{...process.env,HOME:c.home,CLAUDE_CONFI

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L42

1import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L2: var xs=Object.create;var bn=Object.defineProperty;var bs=Object.getOwnPropertyDescriptor;var Ss=Object.getOwnPropertyNames;var ws=Object.getPrototypeOf,ks=Object.prototype.hasOwnPr... L3: `).join(`\r ... L19: ${e}_count ${t.count} L20: `},tn=()=>({dispatched:0,served:0,failed:0,rateLimited:0}),_i=16*1024*1024,yi=e=>new Promise((t,n)=>{let r=[],s=0;e.on("data",o=>{if(s+=o.length,s>_i){e.destroy(),n(new Error("body... L21: `)),n=(f,b,S)=>{let _=new Date().toISOString();if(e.logJson)return JSON.stringify({ts:_,level:f,msg:b,...S});let m=S?" "+Object.entries(S).map(([k,w])=>`${k}=${typeof w=="string"?w... ... L45: L46: `)}function pe(){let e={text:"",thinking:"",usage:Fr(),stop:"stop"};return{s

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L45

dist/cli.jsView file

2import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var $s=Object.create;var An=Object.defineProperty;var js=Object.getOwnPropertyDescriptor;var Fs=Object.getOwnPropertyNames;var Hs=Object.getPrototypeOf,qs=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}function ve(e,t,n,r,s,o){if(e.listenerCount("wsClientError")){let i=new Error(s);Error.captureStackTrace(i,ve),e.emit("wsClientError",i,n,t)}else Ye(n,r,s,o)}});import{spawnSy... L10: data: ${JSON.stringify({type:"error",error:{type:"api_error",message:n}})}

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L2

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> dist/cli.js L2: import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var $s=Object.create;var An=Object.defineProperty;var js=Object.getOwnPropertyDescriptor;var Fs=Object.getOwnPropertyNames;var Hs=Object.getPrototypeOf,qs=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}function ve(e,t,n,r,s,o){if(e.listenerCount("wsClientError")){let i=new Error(s);Error.captureStackTrace(i,ve),e.emit("wsClientError",i,n,t)}else Ye(n,r,s,o)}});import{spawnSy... L10: data: ${JSON.stringify({type:"error",error:{type:"api_error",message:n}})} ... L20: ${e}_count ${t.count} L21: `},cn=()=>({dispatched:0,served:0,failed:0,rateLimited:0}),Li=16*1024*1024,Di=e=>new Promise((t,n)=>{let r=[],s=0;e.on("data",o=>{if

Source & flagged code

7 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L45

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L42

Findings

3 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Low