@octavus/agent@1.0.16
Octavus Agent CLI - run one of your cloud Octavus Agents on a machine you control, using that machine as the agent's computer. The agent lives in the cloud (fully configured and observable); the local machine only supplies the computer and the trigger.
AI Security Review
scanned 29d ago · by lpm-firewall-aiThe configurable destination and token forwarding create a concrete conditional credential-exposure risk. The package has no lifecycle hook or evidence of an automatic malicious action.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the octoagent CLI with an operator URL from its options, environment, or saved configuration.
Impact
A user-selected or environment-controlled operator host could receive a valid computer token; static inspection does not establish malicious use.
Mechanism
The CLI forms /ws/computer from the selected operator URL and adds the computer token to the connection query string.
AI rationale
The configurable destination and token forwarding create a concrete conditional credential-exposure risk. The package has no lifecycle hook or evidence of an automatic malicious action.
Evidence
dist/index.jspackage.json
Network endpoints1
/ws/computer
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI accepts an operator WebSocket URL from a command value, environment variable, or saved configuration without a host allowlist.
- It builds a WebSocket endpoint from that URL and sends the computer token as a query parameter.
- Package metadata exposes a CLI entry point and contains no npm lifecycle hook.
Evidence against
- No install-time script or self-dependency is declared.
- No hidden default recipient or confirmed unauthorized data transfer was identified.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
12 flagged · loading sourcedist/computer-mcp/dist/index.jsView file
53`);if(e===-1)return null;const t=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),x_(t)}clear(){this._buffer=void 0}};function x_(...
L54: `}var I_=class{constructor(e=_4.stdin,t=_4.stdout){this._stdin=e,this._stdout=t,this._readBuffer=new B_,this._started=!1,this._ondata=u=>{this._readBuffer.append(u),this.processRea...
L55: xcode-select --install`)}return e}function q_(){const e=Qn();if(!Xn(e))throw new Error(`Linux driver not found at ${e}. Ensure linux/linux-driver.py exists.`);try{P_(e,493)}catch{}...
High
Child Process
Package source references child process execution.
dist/computer-mcp/dist/index.jsView on unpkg · L53•matchType = normalized_sha256
matchedPackage = @octavus/agent@1.0.0
matchedPath = dist/computer-mcp/dist/index.js
matchedIdentity = npm:QG9jdGF2dXMvYWdlbnQ:1.0.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/computer-mcp/dist/index.jsView on unpkg5|| (${b} === "string" && ${d} && ${d} == +${d} && !(${d} % 1))`).assign(w,(0,r._)`+${d}`);return;case"boolean":D.elseIf((0,r._)`${d} === "false" || ${d} === 0 || ${d} === null`).as...
L6: || ${b} === "boolean" || ${d} === null`).assign(w,(0,r._)`[${d}]`)}}}function _({gen:v,parentData:E,parentDataProperty:x},D){v.if((0,r._)`${E} !== undefined`,()=>v.assign((0,r._)`$...
L7: missingProperty: ${m},
Findings
10 High4 Medium5 Low
HighChild Processdist/computer-mcp/dist/index.js
HighSame File Env Network Executiondist/browser-extension-mcp.js
HighCommand Output Exfiltrationdist/browser-extension-mcp.js
HighObfuscated Payload Loaderdist/filesystem-mcp.mjs
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/browser-extension/assets/index.ts-Bis5r5UE.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/code-mcp/index.js
HighKnown Malware Source Similaritydist/computer-mcp/dist/index.js
HighKnown Malware Source Similaritydist/browser-extension-mcp.js
Medium
Affected versions and remediation
This report applies to @octavus/agent@1.0.16.
See all versions of @octavus/agent for other recorded verdicts.
- Review the evidence and your use of @octavus/agent@1.0.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.