registry / Malware / @guangnao/agent-proxy

@guangnao/agent-proxy

This report shows the evidence for @guangnao/agent-proxy@1.2.1. 3 of 14 known versions are blocked or flagged. The newest version, 1.5.7, is flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14047 confirms this npm version as malicious.

Advisory

MAL-2026-14047

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @guangnao/agent-proxy (npm)

Details

On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub.client-llm.com, reconstructed at runtime via XOR+base64 with key 'gnP2p!7xQ' from a base64 blob in dist/cli.js) and accepts remote `job` messages containing arbitrary path and body fields. These are POSTed into the local proxy and forwarded to api.anthropic.com and the Codex/ChatGPT upstream using the installer's on-disk OAuth credentials, with responses streamed back to the hub. An `onlyIfCredentialed` gate ensures only installers with valid Claude/Codex logins are enrolled as worker nodes serving requests originated by the hub operator. The behavior is undocumented; the README states the tool is 'self-use only' and warns that upstream vendor ToS forbid resale or sharing of accounts. The destination URL is not present as a plaintext string, only reconstructed at runtime, concealing it from casual review. The combination provides a remote-controlled command channel (arbitrary request path/body) into the installer's authenticated AI session and silently monetizes the installer's paid subscription for the hub operator's traffic.

References

OpenSSF/OSV advisory PACKAGE PACKAGE PACKAGE

Independent scan evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 155 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, auth.openai.com, chatgpt.com, console.anthropic.com

Source & flagged code

6 flagged

dist/cli.jsView file

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1

23L24: `),u=(w,C={})=>({id:o,object:"response",created_at:a,status:w,model:t.model,error:null,...C}),y=async()=>{n.started()||await c("response.created",{response:u("in_progress",{output:... L25: Note Auth flows open a browser. No browser on this box? ... L35: L36: `,Gs=e=>e.startsWith("~")?en(_r(),e.slice(1)):e,_t=()=>process.env.CODEX_HOME||en(_r(),".codex"),se=()=>process.env.CODEX_AUTH_FILE||en(_t(),"auth.json"),wr=(e,t)=>{process.platfor... L37:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L23

20L21: `),messages:a,stream:t.stream===!0,maxTokens:typeof t.max_output_tokens=="number"?t.max_output_tokens:void 0}}function ir(e){return{input_tokens:e.usage.inputTokens,output_tokens:e... L22: data: ${JSON.stringify({type:w,sequence_number:d++,...C})} L23: L24: `),u=(w,C={})=>({id:o,object:"response",created_at:a,status:w,model:t.model,error:null,...C}),y=async()=>{n.started()||await c("response.created",{response:u("in_progress",{output:... L25: Note Auth flows open a browser. No browser on this box? ... L35: L36: `,Gs=e=>e.startsWith("~")?en(_r(),e.slice(1)):e,_t=()=>process.env.CODEX_HOME||en(_r(),".codex"),se=()=>process.env.CODEX_AUTH_FILE||en(_t(),"auth.json"),wr=(e,t)=>{process.platfor... L37:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L20

1#!/usr/bin/env node L2: import{createInterface as Ic}from"node:readline/promises";import{spawnSync as We}from"node:child_process";import{stdin as Ro,stdout as Do}from"node:process";var jn="1.0.1";var Te=(... L3: `)}var Z={info:(e,t)=>jt(process.stdout,"info",e,t),warn:(e,t)=>jt(process.stderr,"warn",e,t),error:(e,t)=>jt(process.stderr,"error",e,t)};var it=class{constructor(t,n){this.max=t;... L4: L5: `)}function de(){let e={text:"",thinking:"",usage:Xn(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L6: `}let d=pt(n.maxConcurrency,!!n.claudeToken),i=await d.acquire();try{await ut({bin:n.claudeBin,args:o,prompt:s,cwd:i.workDir,env:{...process.env,HOME:i.home,CLAUDE_CONFIG_DIR:i.con... ... L23: L24: `),u

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

4L5: `)}function de(){let e={text:"",thinking:"",usage:Xn(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text+=n},thinking(n){e.thinking+=n}... L6: `}let d=pt(n.maxConcurrency,!!n.claudeToken),i=await d.acquire();try{await ut({bin:n.claudeBin,args:o,prompt:s,cwd:i.workDir,env:{...process.env,HOME:i.home,CLAUDE_CONFIG_DIR:i.con...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L4

deploy/provision-auth.shView file

•path = deploy/provision-auth.sh kind = build_helper sizeBytes = 2002 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

deploy/provision-auth.shView on unpkg

Source & flagged code

6 flagged · loading source

dist/cli.jsView file

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L23

Findings

5 High4 Medium5 Low

HighChild Processdist/cli.js

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdeploy/provision-auth.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @guangnao/agent-proxy@1.2.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @guangnao/agent-proxy@1.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-14 20:00:12.161Z (UTC).

Source advisory published: 2026-08-14 19:42:12.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

14 known versions

1.5.7latestSuspicious—WarnUnder ReviewJul 29, 2026, 6:12 PM 1.5.6Suspicious—WarnUnder ReviewJul 29, 2026, 4:44 PM 1.5.3Suspicious—WarnUnder ReviewJul 29, 2026, 1:09 PM 1.4.9Suspicious—WarnUnder ReviewJul 25, 2026, 8:29 PM

OpenSSF/OSV Malicious Advisory

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @guangnao

Other malware packages

Related packages

More from @guangnao

Other malware packages

Source & flagged code