registry / Credential exfiltration / @octavus/agent
@octavus/agent
Octavus Agent CLI - run one of your cloud Octavus Agents on a machine you control, using that machine as the agent's computer. The agent lives in the cloud (fully configured and observable); the local machine only supplies the computer and the trigger.
This report shows the evidence for @octavus/agent@1.0.0. 1 of 22 known versions is blocked or flagged. The newest version, 1.0.34, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete credential-harvesting and data-exfiltration chain, not merely a browser automation capability. Lack of install hooks does not mitigate the runtime behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs octoagent; a remote dispatch supplies slackPrefsCapture and browser tools are used.
Impact
Exposure of Slack session credentials and preference data to the remote platform.
Mechanism
Slack token harvesting, authenticated preference retrieval, and callback exfiltration
Attack narrative
The executable includes a Slack-specific capture routine. It searches browser storage and page data for xoxc tokens, hooks fetch and XMLHttpRequest to observe authorization material, then calls Slack's users.prefs.get with the token and browser cookies. The capture is initiated automatically after browser tool activity when a remote dispatch enables slackPrefsCapture, and the result is sent to a configured report callback. This credential and data collection is not disclosed as a required CLI action.
AI rationale
This is a concrete credential-harvesting and data-exfiltration chain, not merely a browser automation capability. Lack of install hooks does not mitigate the runtime behavior.
Evidence
dist/index.jspackage.json
Network endpoints2
slack.comoctavus.ai
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Extracts Slack xoxc tokens from localStorage and page boot data.
- Intercepts page fetch/XHR requests to capture Slack authorization tokens.
- Uses the captured token and cookies to call Slack users.prefs.get.
- Automatically reports captured Slack preferences through a configured callback.
Evidence against
- No npm lifecycle scripts are declared.
- The package exposes an explicit CLI bin rather than import-time execution.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcedist/computer-mcp/dist/index.jsView file
53`);if(e===-1)return null;const t=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),x_(t)}clear(){this._buffer=void 0}};function x_(...
L54: `}var I_=class{constructor(e=_4.stdin,t=_4.stdout){this._stdin=e,this._stdout=t,this._readBuffer=new B_,this._started=!1,this._ondata=u=>{this._readBuffer.append(u),this.processRea...
L55: xcode-select --install`)}return e}function q_(){const e=Qn();if(!Xn(e))throw new Error(`Linux driver not found at ${e}. Ensure linux/linux-driver.py exists.`);try{P_(e,493)}catch{}...
High
Child Process
Package source references child process execution.
dist/computer-mcp/dist/index.jsView on unpkg · L535|| (${A} === "string" && ${f} && ${f} == +${f} && !(${f} % 1))`).assign(U,(0,r._)`+${f}`);return;case"boolean":E.elseIf((0,r._)`${f} === "false" || ${f} === 0 || ${f} === null`).as...
L6: || ${A} === "boolean" || ${f} === null`).assign(U,(0,r._)`[${f}]`)}}}function D({gen:p,parentData:_,parentDataProperty:C},E){p.if((0,r._)`${_} !== undefined`,()=>p.assign((0,r._)`$...
L7: missingProperty: ${d},
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/computer-mcp/dist/index.jsView on unpkg · L5dist/browser-extension-mcp.js
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/computer-mcp/dist/index.js
HighSame File Env Network Executiondist/browser-extension-mcp.js
HighCommand Output Exfiltrationdist/browser-extension-mcp.js
HighObfuscated Payload Loaderdist/filesystem-mcp.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/computer-mcp/linux/linux-driver.py
MediumStructural Risk Force Deep Review
LowEvaldist/computer-mcp/dist/index.js
LowFilesystem
Low
Affected versions and remediation
This report applies to @octavus/agent@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @octavus/agent@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.