@ikbal_fadilah_vanexa01/vanexa-agent@1.3.24: Malicious npm | LPM Firewall

Loading npm security reports…

@ikbal_fadilah_vanexa01/vanexa-agent@1.3.24: Malicious npm | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle.cjsView file

211${i("Argument: %s, Given: %s, Choices: %s",g,e.stringifiedValues(f[g]),e.stringifiedValues(h.choices[g]))}`}),e.fail(m)};let o={};s.implies=function(d,h){he("<string|object> [array... L212: `;h.forEach(p=>{f+=p}),e.fail(f)}};let c={};s.conflicts=function(d,h){he("<string|object> [array|string]",[d,h],arguments.length),typeof d=="object"?Object.keys(d).forEach(f=>{s.co... L213: `),void 0,"versionWarning"),D(this,we,"f").key[e]=!0,t.alias&&this.alias(e,t.alias);let i=t.deprecate||t.deprecated;i&&this.deprecateOption(e,i);let n=t.demand||t.required||t.requi... L214: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")},error:(...e)=>{this[z2]()||console.error(...e),pe(this,Ti,!0,"f"),D(this,xr,"f").length&&pe(this,xr,D(this,xr,"f")+` L215: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")}

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle.cjsView on unpkg · L211

•context = eplace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#r("destroy",...e)}destroySoon(...e){return this.#r("destroySoon",...e)}close(...e){return this.#r("close",...e)}};RL.exports=uk});function yw(){Rr.default.existsSync(Vf)||Rr.default.mkdirSync(Vf,{recursive:!0,mode:448})}function VL(){if(yw(),!Rr.default.existsSync(dk)){let r=cc.default.randomBytes(32);return Rr.default.writeFileSync(dk,r,{mode:384}),r}return Rr.default.readFileSync(dk)}function GL(r){if(!r||r.startsWith("ENC:"))return r;let e=VL(),t=cc.default.randomBytes(16),i=cc.default.createCipheriv("aes-256-gcm",e,t),n=i.update(r,"utf8","hex");n+=i.final("hex");let s=i.getAuthTag

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundle.cjsView on unpkg

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}F5.suggestSimilar=SY});var L5=w(B5=>{var kY=require("events").EventEmitter,fC=require("child_process"),hs=require("path"),pC=require("fs"),Tt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(...

High

Child Process

Package source references child process execution.

dist/bundle.cjsView on unpkg · L9

39`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function RR(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L40: `);return s!==-1&&(e=Qfe(e,n,i,s)),i+e+n},QE,$R=(r,...e)=>{let[t]=e;if(!db(t)||!db(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String(... L41: `))this.lineCount+=Math.max(1,Math.ceil(y0e(i)/e))}get isEnabled(){return this._isEnabled&&!this.isSilent}set isEnabled(e){if(typeof e!="boolean")throw new TypeError("The `isEnable... ... L47: \v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L48: \v\f\r\x1B !"#$%&'

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundle.cjsView on unpkg · L39

33`,n)}while(i!==-1);return s+=r.substr(n),s};eR.exports={stringReplaceAll:Sfe,stringEncaseCRLFWithFirstIndex:kfe}});var oR=w((e6e,sR)=>{"use strict";var Afe=/(?:\\(u(?:[a-f\d]{4}|\{... L34: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function nR(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L35: `);return s!==-1&&(e=Rfe(e,n,i,s)),i+e+n},HE,dR=(r,...e)=>{let[t]=e;if(!Zx(t)||!Zx(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String(... L36: `:` ... L39: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function RR(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5|... L40: `);return s!==-1&&(e=Qfe(e

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle.cjsView on unpkg · L33

1var pY=Object.create;var iC=Object.defineProperty;var mY=Object.getOwnPropertyDescriptor;var gY=Object.getOwnPropertyNames;var yY=Object.getPrototypeOf,xY=Object.prototype.hasOwnPr... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(p=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}F5.suggestSimilar=SY});var L5=w(B5=>{var kY=require("events").EventEmitter,fC=require("child_process"),hs=require("path"),pC=require("fs"),Tt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bundle.cjsView on unpkg · L1

214`,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")},error:(...e)=>{this[z2]()||console.error(...e),pe(this,Ti,!0,"f"),D(this,xr,"f").length&&pe(this,xr,D(this,xr,"f")+` L215: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")}}}[W3](e){mh(D(this,we,"f")).forEach(t=>{if((n=>n==="configObjects")(t))return;let i=D(this,we,"f")[t];Array.isArray(i)?i.includes... L216: `).map(U=>U.trim()).filter(U=>!!U);if(!m||!g)throw new Error(`Invalid DevToolsActivePort '${p}' found`);let y=parseInt(m,10);if(isNaN(y)||y<=0||y>65535)throw new Error(`Invalid por... L217: `);throw Re.includes("Failed to create a ProcessSingleton for your profile directory")||process.platform==="win32"&&(0,l0.existsSync)((0,lT.join)(B.userDataDir,"lockfile"))?new Err... L218: 1. you did not perform an installation before runn

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.cjsView on unpkg · L214

1var pY=Object.create;var iC=Object.defineProperty;var mY=Object.getOwnPropertyDescriptor;var gY=Object.getOwnPropertyNames;var yY=Object.getPrototypeOf,xY=Object.prototype.hasOwnPr... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(p=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}F5.suggestSimilar=SY});var L5=w(B5=>{var kY=require("events").EventEmitter,fC=require("child_process"),hs=require("path"),pC=require("fs"),Tt=require("p... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bundle.cjsView on unpkg · L1

bin/vanexa-agent.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = vanexa-agent@1.1.42 matchedPath = bin/vanexa-agent.js matchedIdentity = npm:dmFuZXhhLWFnZW50:1.1.42 similarity = 0.667 shingleOverlap = 2 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/vanexa-agent.jsView on unpkg

12L13: const require = createRequire(import.meta.url); L14: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L12

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 5691752 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 7284 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 5-45json

5 "main": "bin/vanexa-agent.js",

6 "type": "module",

7 "bin": {

8 "vanexa-agent": "bin/vanexa-agent.js"

9 },

10 "files": [

11 "bin/",

12 "dist/bundle.jsc",

13 "dist/bundle.cjs",

14 "dist/.v8-version",

15 "scripts/",

16 "README.md",

17 "install.sh",

18 "install.ps1"

19 ],

20 "scripts": {

21 "start": "node ./bin/vanexa-agent.js",

22 "test": "echo \"Tests will be implemented in future\" && exit 0",

23 "build": "node scripts/build_bytecode.js",

24 "prepublishOnly": "node scripts/build_bytecode.js",

25 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 },

27 "engines": {

28 "node": ">=24.0.0"

29 },

30 "keywords": [

31 "ai",

32 "agent",

33 "automation",

34 "vanexa",

35 "cli"

36 ],

37 "author": "Ikbal Fadilah",

38 "license": "MIT",

39 "repository": {

40 "type": "git",

41 "url": "https://github.com/ikbalsakata500445jensen/vanexa-agent"

42 },

43 "dependencies": {

44 "@babel/parser": "^8.0.4",

45 "@xenova/transformers": "^2.17.2",

dist/bundle.cjsView file

211${i("Argument: %s, Given: %s, Choices: %s",g,e.stringifiedValues(f[g]),e.stringifiedValues(h.choices[g]))}`}),e.fail(m)};let o={};s.implies=function(d,h){he("<string|object> [array... L212: `;h.forEach(p=>{f+=p}),e.fail(f)}};let c={};s.conflicts=function(d,h){he("<string|object> [array|string]",[d,h],arguments.length),typeof d=="object"?Object.keys(d).forEach(f=>{s.co... L213: `),void 0,"versionWarning"),D(this,we,"f").key[e]=!0,t.alias&&this.alias(e,t.alias);let i=t.deprecate||t.deprecated;i&&this.deprecateOption(e,i);let n=t.demand||t.required||t.requi... L214: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")},error:(...e)=>{this[z2]()||console.error(...e),pe(this,Ti,!0,"f"),D(this,xr,"f").length&&pe(this,xr,D(this,xr,"f")+` L215: `,"f"),pe(this,xr,D(this,xr,"f")+e.join(" "),"f")}

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle.cjsView on unpkg · L211

•context = eplace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#r("destroy",...e)}destroySoon(...e){return this.#r("destroySoon",...e)}close(...e){return this.#r("close",...e)}};RL.exports=uk});function yw(){Rr.default.existsSync(Vf)||Rr.default.mkdirSync(Vf,{recursive:!0,mode:448})}function VL(){if(yw(),!Rr.default.existsSync(dk)){let r=cc.default.randomBytes(32);return Rr.default.writeFileSync(dk,r,{mode:384}),r}return Rr.default.readFileSync(dk)}function GL(r){if(!r||r.startsWith("ENC:"))return r;let e=VL(),t=cc.default.randomBytes(16),i=cc.default.createCipheriv("aes-256-gcm",e,t),n=i.update(r,"utf8","hex");n+=i.final("hex");let s=i.getAuthTag

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundle.cjsView on unpkg

bin/vanexa-agent.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * VANEXA AGENT - Sovereign Digital Brain

4 * V8 Bytecode Launcher with Runtime Version Guard

5 */

6import path from 'path';

7import fs from 'fs';

8

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 5691752 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 7284 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg