Loading npm security reports…

@ikbal_fadilah_vanexa01/vanexa-agent@1.3.14: Malicious npm | LPM Firewall

registry / @ikbal_fadilah_vanexa01/vanexa-agent / 1.3.14

@ikbal_fadilah_vanexa01/vanexa-agent@1.3.14

This package has been officially migrated to @vanexalabs-ai/vanexa-agent. Please install using: npm install -g @vanexalabs-ai/vanexa-agent

Sovereign AI Agent Desktop Daemon

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13364 confirms this npm version as malicious. Package ships an agent daemon (`vanexa-agent start`, entry `bin/vanexa-agent.js`) that receives commands from a remote phone app and executes them on the installer's host via `child_process`/`spawn`, including `powershell.exe` and inline JS/Python evaluation...

Advisory

MAL-2026-13364

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)

Details

Package ships an agent daemon (`vanexa-agent start`, entry `bin/vanexa-agent.js`) that receives commands from a remote phone app and executes them on the installer's host via `child_process`/`spawn`, including `powershell.exe` and inline JS/Python evaluation. Rather than the LAN-only WebSocket architecture described in the README (which claims BYOK with `no middleman`), the compiled bundle hardcodes two Cloudflare Workers endpoints — `vanexa-agent-relay.hanazaki542.workers.dev` and `vanexa-ai-proxy.hanazaki542.workers.dev` — hosted on a personal Cloudflare account (`hanazaki542`) that does not match the npm publisher (`ikbalsakata500445jensen`). Commands from the phone client and, via the AI proxy path, user-supplied prompt content and API tokens transit this third-party intermediary before reaching the local execution sinks on the installer's machine. The primary runtime is shipped as V8 bytecode (`dist/bundle.jsc`) produced from `dist/bundle.cjs` at postinstall via `bytenode.compileFile`, and the bin entry loads that bytecode with `require(bytecodePath)`, reducing auditability of the network-driven exec path. The combination — network-sourced commands flowing into local shell/child_process, a hardcoded author-controlled relay whose ownership does not match the publisher, and a bytecode-compiled payload — makes normal operator use of this agent equivalent to granting the relay operator remote command execution on the installer's host.

Decision reason

High-risk behavior combination matched malicious policy.; source closely matched a different package identity

References

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle.cjsView file

211${i("Argument: %s, Given: %s, Choices: %s",g,e.stringifiedValues(f[g]),e.stringifiedValues(h.choices[g]))}`}),e.fail(m)};let o={};s.implies=function(d,h){ue("<string|object> [array... L212: `;h.forEach(p=>{f+=p}),e.fail(f)}};let c={};s.conflicts=function(d,h){ue("<string|object> [array|string]",[d,h],arguments.length),typeof d=="object"?Object.keys(d).forEach(f=>{s.co... L213: `),void 0,"versionWarning"),_(this,me,"f").key[e]=!0,t.alias&&this.alias(e,t.alias);let i=t.deprecate||t.deprecated;i&&this.deprecateOption(e,i);let n=t.demand||t.required||t.requi... L214: `,"f"),le(this,ar,_(this,ar,"f")+e.join(" "),"f")},error:(...e)=>{this[a2]()||console.error(...e),le(this,yi,!0,"f"),_(this,ar,"f").length&&le(this,ar,_(this,ar,"f")+` L215: `,"f"),le(this,ar,_(this,ar,"f")+e.join(" "),"f")}

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle.cjsView on unpkg · L211

•context = eplace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#r("destroy",...e)}destroySoon(...e){return this.#r("destroySoon",...e)}close(...e){return this.#r("close",...e)}};mL.exports=a6});function Tw(){Dr.default.existsSync(cf)||Dr.default.mkdirSync(cf,{recursive:!0,mode:448})}function CL(){if(Tw(),!Dr.default.existsSync(u6)){let r=Ma.default.randomBytes(32);return Dr.default.writeFileSync(u6,r,{mode:384}),r}return Dr.default.readFileSync(u6)}function SL(r){if(!r||r.startsWith("ENC:"))return r;let e=CL(),t=Ma.default.randomBytes(16),i=Ma.default.createCipheriv("aes-256-gcm",e,t),n=i.update(r,"utf8","hex");n+=i.final("hex");let s=i.getAuthTag

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundle.cjsView on unpkg

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}l3.suggestSimilar=mV});var y3=w(g3=>{var gV=require("events").EventEmitter,dD=require("child_process"),Hn=require("path"),hD=require("fs"),Dt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(...

High

Child Process

Package source references child process execution.

dist/bundle.cjsView on unpkg · L9

39`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function m7(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L40: `);return s!==-1&&(e=$de(e,n,i,s)),i+e+n},XE,_7=(r,...e)=>{let[t]=e;if(!Cx(t)||!Cx(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String(... L41: `))this.lineCount+=Math.max(1,Math.ceil(ope(i)/e))}get isEnabled(){return this._isEnabled&&!this.isSilent}set isEnabled(e){if(typeof e!="boolean")throw new TypeError("The `isEnable... ... L47: \v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L48: \v\f\r\x1B !"#$%&'

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundle.cjsView on unpkg · L39

33`,n)}while(i!==-1);return s+=r.substr(n),s};MM.exports={stringReplaceAll:mde,stringEncaseCRLFWithFirstIndex:gde}});var qM=w((iEe,jM)=>{"use strict";var yde=/(?:\\(u(?:[a-f\d]{4}|\{... L34: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function NM(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L35: `);return s!==-1&&(e=Ede(e,n,i,s)),i+e+n},UE,GM=(r,...e)=>{let[t]=e;if(!fx(t)||!fx(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String(... L36: `:` ... L39: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function m7(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L40: `);return s!==-1&&(e=$de(e

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle.cjsView on unpkg · L33

1var iV=Object.create;var tD=Object.defineProperty;var nV=Object.getOwnPropertyDescriptor;var sV=Object.getOwnPropertyNames;var oV=Object.getPrototypeOf,aV=Object.prototype.hasOwnPr... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(p=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}l3.suggestSimilar=mV});var y3=w(g3=>{var gV=require("events").EventEmitter,dD=require("child_process"),Hn=require("path"),hD=require("fs"),Dt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bundle.cjsView on unpkg · L1

214`,"f"),le(this,ar,_(this,ar,"f")+e.join(" "),"f")},error:(...e)=>{this[a2]()||console.error(...e),le(this,yi,!0,"f"),_(this,ar,"f").length&&le(this,ar,_(this,ar,"f")+` L215: `,"f"),le(this,ar,_(this,ar,"f")+e.join(" "),"f")}}}[$P](e){Bd(_(this,me,"f")).forEach(t=>{if((n=>n==="configObjects")(t))return;let i=_(this,me,"f")[t];Array.isArray(i)?i.includes... L216: `).map(B=>B.trim()).filter(B=>!!B);if(!m||!g)throw new Error(`Invalid DevToolsActivePort '${p}' found`);let y=parseInt(m,10);if(isNaN(y)||y<=0||y>65535)throw new Error(`Invalid por... L217: `);throw Ie.includes("Failed to create a ProcessSingleton for your profile directory")||process.platform==="win32"&&(0,Fm.existsSync)((0,cT.join)(A.userDataDir,"lockfile"))?new Err... L218: 1. you did not perform an installation before runn

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.cjsView on unpkg · L214

1var iV=Object.create;var tD=Object.defineProperty;var nV=Object.getOwnPropertyDescriptor;var sV=Object.getOwnPropertyNames;var oV=Object.getPrototypeOf,aV=Object.prototype.hasOwnPr... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(p=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}l3.suggestSimilar=mV});var y3=w(g3=>{var gV=require("events").EventEmitter,dD=require("child_process"),Hn=require("path"),hD=require("fs"),Dt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bundle.cjsView on unpkg · L1

bin/vanexa-agent.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = vanexa-agent@1.1.42 matchedPath = bin/vanexa-agent.js matchedIdentity = npm:dmFuZXhhLWFnZW50:1.1.42 similarity = 0.667 shingleOverlap = 2 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/vanexa-agent.jsView on unpkg

12L13: const require = createRequire(import.meta.url); L14: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L12

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 5405160 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 7284 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 5-45json

5 "main": "bin/vanexa-agent.js",

6 "type": "module",

7 "bin": {

8 "vanexa-agent": "bin/vanexa-agent.js"

9 },

10 "files": [

11 "bin/",

12 "dist/bundle.jsc",

13 "dist/bundle.cjs",

14 "dist/.v8-version",

15 "scripts/",

16 "README.md",

17 "install.sh",

18 "install.ps1"

19 ],

20 "scripts": {

21 "start": "node ./bin/vanexa-agent.js",

22 "test": "echo \"Tests will be implemented in future\" && exit 0",

23 "build": "node scripts/build_bytecode.js",

24 "prepublishOnly": "node scripts/build_bytecode.js",

25 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 },

27 "engines": {

28 "node": ">=24.0.0"

29 },

30 "keywords": [

31 "ai",

32 "agent",

33 "automation",

34 "vanexa",

35 "cli"

36 ],

37 "author": "Ikbal Fadilah",

38 "license": "MIT",

39 "repository": {

40 "type": "git",

41 "url": "https://github.com/ikbalsakata500445jensen/vanexa-agent"

42 },

43 "dependencies": {

44 "@xenova/transformers": "^2.17.2",

45 "better-sqlite3": "^12.11.1",

dist/bundle.cjsView file

211${i("Argument: %s, Given: %s, Choices: %s",g,e.stringifiedValues(f[g]),e.stringifiedValues(h.choices[g]))}`}),e.fail(m)};let o={};s.implies=function(d,h){ue("<string|object> [array... L212: `;h.forEach(p=>{f+=p}),e.fail(f)}};let c={};s.conflicts=function(d,h){ue("<string|object> [array|string]",[d,h],arguments.length),typeof d=="object"?Object.keys(d).forEach(f=>{s.co... L213: `),void 0,"versionWarning"),_(this,me,"f").key[e]=!0,t.alias&&this.alias(e,t.alias);let i=t.deprecate||t.deprecated;i&&this.deprecateOption(e,i);let n=t.demand||t.required||t.requi... L214: `,"f"),le(this,ar,_(this,ar,"f")+e.join(" "),"f")},error:(...e)=>{this[a2]()||console.error(...e),le(this,yi,!0,"f"),_(this,ar,"f").length&&le(this,ar,_(this,ar,"f")+` L215: `,"f"),le(this,ar,_(this,ar,"f")+e.join(" "),"f")}

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle.cjsView on unpkg · L211

•context = eplace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#r("destroy",...e)}destroySoon(...e){return this.#r("destroySoon",...e)}close(...e){return this.#r("close",...e)}};mL.exports=a6});function Tw(){Dr.default.existsSync(cf)||Dr.default.mkdirSync(cf,{recursive:!0,mode:448})}function CL(){if(Tw(),!Dr.default.existsSync(u6)){let r=Ma.default.randomBytes(32);return Dr.default.writeFileSync(u6,r,{mode:384}),r}return Dr.default.readFileSync(u6)}function SL(r){if(!r||r.startsWith("ENC:"))return r;let e=CL(),t=Ma.default.randomBytes(16),i=Ma.default.createCipheriv("aes-256-gcm",e,t),n=i.update(r,"utf8","hex");n+=i.final("hex");let s=i.getAuthTag

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundle.cjsView on unpkg

bin/vanexa-agent.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * VANEXA AGENT - Sovereign Digital Brain

4 * V8 Bytecode Launcher with Runtime Version Guard

5 */

6import path from 'path';

7import fs from 'fs';

8

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 5405160 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 7284 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg