registry / Credential exfiltration / @ikbal_fadilah_vanexa01/vanexa-agent

@ikbal_fadilah_vanexa01/vanexa-agent

Sovereign AI Agent Desktop Daemon

This report shows the evidence for @ikbal_fadilah_vanexa01/vanexa-agent@1.3.24. 36 of 36 known versions are blocked or flagged. The newest version, 1.3.45, is blocked. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms a concrete credential-exfiltration and remote-command-control chain, not merely a bytecode or network heuristic. The explicit runtime trigger does not remove the risk of sending decrypted credentials and accepting privileged relay control.

Static reason

High-risk behavior combination matched malicious policy.; source closely matched a different package identity

Trigger

User runs and pairs `vanexa-agent start`; postinstall also compiles the opaque runtime bundle.

Impact

Remote relay compromise or operator control can expose API keys and execute commands with the daemon user's privileges.

Mechanism

credential forwarding plus relay-controlled autonomous shell execution

Attack narrative

The runtime decrypts the local API key, then includes the full configuration in a daemon-status message to a third-party relay. That same relay can set grantAllAccess and workspace paths and submit tasks to an autonomous agent that exposes shell execution. This establishes both credential exfiltration and relay-controlled code execution after the user starts and pairs the daemon.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/bundle.cjsbin/vanexa-agent.js~/.vanexa/config.json~/.vanexa/session.jwt~/.vanexa/daemon.pid

Network endpoints2

vanexa-agent-relay.hanazaki542.workers.devwss://vanexa-agent-relay.hanazaki542.workers.dev/ws/daemon/<sessionId>

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/bundle.cjs decrypts the stored API key before use.
Its daemon sends `config: yt()` to the relay; yt() returns decrypted config.
Relay `config_update` can set `grantAllAccess` and workspace paths.
Relay `task_request` starts an autonomous task execution loop.
The bundle exposes a shell-command tool via `/bin/bash` or `cmd.exe`.
Runtime auto-update runs `npm install -g ...@latest`.

Evidence against

postinstall only compiles the shipped bundle and handles its own daemon PID.
No foreign AI-agent configuration paths were found in install scripts.
Daemon operation requires an explicit paired `vanexa-agent start` action.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle.cjsView file

211${i("Argument: %s, Given: %s, Choices: %s",g,e.stringifiedValues(f[g]),e.stringifiedValues(h.choices[g]))}`}),e.fail(m)};let o={};s.implies=function(d,h){he("<string|object> [array... L212: `;h.forEach(p=>{f+=p}),e.fail(f)}};let c={};s.conflicts=function(d,h){he("<string|object> [array|string]",[d,h],arguments.length),typeof d=="object"?Object.keys(d).forEach(f=>{s.co... L213: `),void 0,"versionWarning"),D(this,we,"f").key[e]=!0,t.alias&&this.alias(e,t.alias);let i=t.deprecate||t.deprecated;i&&this.deprecateOption(e,i);let n=t.demand||t.required||t.requi... L214: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")},error:(...e)=>{this[z2]()||console.error(...e),pe(this,Ti,!0,"f"),D(this,xr,"f").length&&pe(this,xr,D(this,xr,"f")+` L215: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")}

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle.cjsView on unpkg · L211

•context = eplace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#r("destroy",...e)}destroySoon(...e){return this.#r("destroySoon",...e)}close(...e){return this.#r("close",...e)}};RL.exports=uk});function yw(){Rr.default.existsSync(Vf)||Rr.default.mkdirSync(Vf,{recursive:!0,mode:448})}function VL(){if(yw(),!Rr.default.existsSync(dk)){let r=cc.default.randomBytes(32);return Rr.default.writeFileSync(dk,r,{mode:384}),r}return Rr.default.readFileSync(dk)}function GL(r){if(!r||r.startsWith("ENC:"))return r;let e=VL(),t=cc.default.randomBytes(16),i=cc.default.createCipheriv("aes-256-gcm",e,t),n=i.update(r,"utf8","hex");n+=i.final("hex");let s=i.getAuthTag

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundle.cjsView on unpkg

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}F5.suggestSimilar=SY});var L5=w(B5=>{var kY=require("events").EventEmitter,fC=require("child_process"),hs=require("path"),pC=require("fs"),Tt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(...

High

Child Process

Package source references child process execution.

dist/bundle.cjsView on unpkg · L9

39`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function RR(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L40: `);return s!==-1&&(e=Qfe(e,n,i,s)),i+e+n},QE,$R=(r,...e)=>{let[t]=e;if(!db(t)||!db(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String(... L41: `))this.lineCount+=Math.max(1,Math.ceil(y0e(i)/e))}get isEnabled(){return this._isEnabled&&!this.isSilent}set isEnabled(e){if(typeof e!="boolean")throw new TypeError("The `isEnable... ... L47: \v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L48: \v\f\r\x1B !"#$%&'

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundle.cjsView on unpkg · L39

33`,n)}while(i!==-1);return s+=r.substr(n),s};eR.exports={stringReplaceAll:Sfe,stringEncaseCRLFWithFirstIndex:kfe}});var oR=w((e6e,sR)=>{"use strict";var Afe=/(?:\\(u(?:[a-f\d]{4}|\{... L34: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function nR(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L35: `);return s!==-1&&(e=Rfe(e,n,i,s)),i+e+n},HE,dR=(r,...e)=>{let[t]=e;if(!Zx(t)||!Zx(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String(... L36: `:` ... L39: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function RR(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L40: `);return s!==-1&&(e=Qfe(e

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle.cjsView on unpkg · L33

1var pY=Object.create;var iC=Object.defineProperty;var mY=Object.getOwnPropertyDescriptor;var gY=Object.getOwnPropertyNames;var yY=Object.getPrototypeOf,xY=Object.prototype.hasOwnPr... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(p=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}F5.suggestSimilar=SY});var L5=w(B5=>{var kY=require("events").EventEmitter,fC=require("child_process"),hs=require("path"),pC=require("fs"),Tt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bundle.cjsView on unpkg · L1

214`,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")},error:(...e)=>{this[z2]()||console.error(...e),pe(this,Ti,!0,"f"),D(this,xr,"f").length&&pe(this,xr,D(this,xr,"f")+` L215: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")}}}[W3](e){mh(D(this,we,"f")).forEach(t=>{if((n=>n==="configObjects")(t))return;let i=D(this,we,"f")[t];Array.isArray(i)?i.includes... L216: `).map(U=>U.trim()).filter(U=>!!U);if(!m||!g)throw new Error(`Invalid DevToolsActivePort '${p}' found`);let y=parseInt(m,10);if(isNaN(y)||y<=0||y>65535)throw new Error(`Invalid por... L217: `);throw Re.includes("Failed to create a ProcessSingleton for your profile directory")||process.platform==="win32"&&(0,l0.existsSync)((0,lT.join)(B.userDataDir,"lockfile"))?new Err... L218: 1. you did not perform an installation before runn

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.cjsView on unpkg · L214

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bundle.cjsView on unpkg · L1

bin/vanexa-agent.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = vanexa-agent@1.1.42 matchedPath = bin/vanexa-agent.js matchedIdentity = npm:dmFuZXhhLWFnZW50:1.1.42 similarity = 0.667 shingleOverlap = 2 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/vanexa-agent.jsView on unpkg

12L13: const require = createRequire(import.meta.url); L14: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L12

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 5691752 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 7284 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle.cjsView file

Findings

2 Critical8 High7 Medium6 Low

CriticalRemote Asset Decode Executedist/bundle.cjs

CriticalEncrypted Payload Temp Executiondist/bundle.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bundle.cjs

HighSame File Env Network Executiondist/bundle.cjs

HighCommand Output Exfiltrationdist/bundle.cjs

HighSandbox Evasion Gated Capabilitydist/bundle.cjs

HighRuntime Package Installdist/bundle.cjs

HighShips Node Bytecodedist/bundle.jsc

HighPackage Source Clone Identity Mismatchbin/vanexa-agent.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

Medium

Affected versions and remediation

This report applies to @ikbal_fadilah_vanexa01/vanexa-agent@1.3.24.

The versions list below shows the verdict for each recorded version.

Avoid installing @ikbal_fadilah_vanexa01/vanexa-agent@1.3.24. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-29 19:56:38.528Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

36 known versions

1.3.45latestMaliciousMalwareBlockPublishedAug 2, 2026, 6:39 PM 1.3.44MaliciousMalwareBlockPublishedAug 2, 2026, 6:38 PM 1.3.40MaliciousMalwareBlockPublishedAug 2, 2026, 3:30 AM 1.3.37MaliciousMalwareBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code