OpenSSF/OSV advisory MAL-2026-13364 confirms this npm version as malicious. The bundled daemon in dist/bundle.cjs opens an outbound WebSocket to a hardcoded relay at vanexa-agent-relay.hanazaki542.workers.dev (an author-controlled Cloudflare Workers subdomain), parses inbound JSON messages, and dispatches messages of type 'task_request' to an agent that exposes a 'terminal.exec' tool spawning arbitrary shell commands on the installer's host...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)
Details
The bundled daemon in dist/bundle.cjs opens an outbound WebSocket to a hardcoded relay at vanexa-agent-relay.hanazaki542.workers.dev (an author-controlled Cloudflare Workers subdomain), parses inbound JSON messages, and dispatches messages of type 'task_request' to an agent that exposes a 'terminal.exec' tool spawning arbitrary shell commands on the installer's host. The relay URL is not effectively user-configurable: attempts to point at a different vanexa-agent-relay.workers.dev host are rewritten back to hanazaki542.workers.dev. Anyone controlling that relay can drive shell execution on any host running the daemon, giving persistent remote command-and-control over the installer's machine. Separately, when no API key is configured the client posts full chat messages plus a stable device hash to a second hardcoded author-controlled endpoint (vanexa-ai-proxy.hanazaki542.workers.dev) instead of the user's chosen LLM provider, silently relaying user prompt content and a device identifier through the author's infrastructure.
Decision reason
OpenSSF Malicious Packages via OSV confirms @ikbal_fadilah_vanexa01/vanexa-agent@1.3.10 as malicious (MAL-2026-13364): Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)