registry / @octavus/agent / 1.0.18

@octavus/agent@1.0.18

Octavus Agent CLI - run one of your cloud Octavus Agents on a machine you control, using that machine as the agent's computer. The agent lives in the cloud (fully configured and observable); the local machine only supplies the computer and the trigger.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Static inspection found an explicit CLI/MCP tool package without lifecycle hooks or a concrete malicious behavior. The indicated agent-related path reads instruction files rather than modifying agent configuration.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Explicit invocation of the CLI or an MCP component.

Impact

No unconsented persistence, credential export, destructive action, or foreign agent-control mutation was established.

Mechanism

The inspected components process command-line input or standard-input transport data; no install-time execution or agent-configuration write was found.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a CLI entrypoint and contains no lifecycle scripts.
The main program acts on an explicit `run` command and accepts caller-provided prompt, workspace, and connection options.
The indicated agent-integration code reads project instruction files for collection; the inspected excerpt shows no configuration write.
The computer and code MCP bundles use standard input to receive transport data.
The browser MCP bundle starts from command-line arguments, and the browser asset connects only to a loopback WebSocket.
The filesystem MCP requires directories supplied through command-line arguments.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

Source & flagged code

12 flagged

dist/computer-mcp/dist/index.jsView file

53`);if(e===-1)return null;const t=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),x_(t)}clear(){this._buffer=void 0}};function x_(... L54: `}var I_=class{constructor(e=_4.stdin,t=_4.stdout){this._stdin=e,this._stdout=t,this._readBuffer=new B_,this._started=!1,this._ondata=u=>{this._readBuffer.append(u),this.processRea... L55: xcode-select --install`)}return e}function q_(){const e=Qn();if(!Xn(e))throw new Error(`Linux driver not found at ${e}. Ensure linux/linux-driver.py exists.`);try{P_(e,493)}catch{}...

High

Child Process

Package source references child process execution.

dist/computer-mcp/dist/index.jsView on unpkg · L53

•matchType = normalized_sha256 matchedPackage = @octavus/agent@1.0.0 matchedPath = dist/computer-mcp/dist/index.js matchedIdentity = npm:QG9jdGF2dXMvYWdlbnQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/computer-mcp/dist/index.jsView on unpkg

5|| (${b} === "string" && ${d} && ${d} == +${d} && !(${d} % 1))`).assign(w,(0,r._)`+${d}`);return;case"boolean":D.elseIf((0,r._)`${d} === "false" || ${d} === 0 || ${d} === null`).as... L6: || ${b} === "boolean" || ${d} === null`).assign(w,(0,r._)`[${d}]`)}}}function _({gen:v,parentData:E,parentDataProperty:x},D){v.if((0,r._)`${E} !== undefined`,()=>v.assign((0,r._)`$... L7: missingProperty: ${m},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/computer-mcp/dist/index.jsView on unpkg · L5

dist/browser-extension-mcp.jsView file

5|| (${y} === "string" && ${d} && ${d} == +${d} && !(${d} % 1))`).assign(b,(0,r._)`+${d}`);return;case"boolean":g.elseIf((0,r._)`${d} === "false" || ${d} === 0 || ${d} === null`).as... L6: || ${y} === "boolean" || ${d} === null`).assign(b,(0,r._)`[${d}]`)}}}function _({gen:v,parentData:$,parentDataProperty:S},g){v.if((0,r._)`${$} !== undefined`,()=>v.assign((0,r._)`$... L7: missingProperty: ${f}, L8: depsCount: ${c}, L9: deps: ${l}}`};var r={keyword:"dependencies",type:"object",schemaType:"object",error:e.error,code(s){const[c,l]=i(s);a(s,c),o(s,l)}};function i({schema:s}){const c={},l={};for(const... L10: `).join(`\r

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/browser-extension-mcp.jsView on unpkg · L5

51L52: `)}_.write("payload.value = newResult;"),_.write("return payload;");const D=_.compile();return(v,$)=>D(h,v,$)};let i;const a=Dr,o=!uu.jitless,c=o&&p0.value,l=t.catchall;let f;e._zo... L53: L54: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(const a of e.seen.entries()){const o=a[1];if(t===a[0]){i(a);continue}if(e.external){const c=e... L55: ]))`;continue}else if(u[s]==="$"){r+=`($|(?=[\r ... L59: `);if(e===-1)return null;const t=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),D3(t)}clear(){this._buffer=void 0}};function D3(... L60: `}var $3=class{constructor(e=qp.stdin,t=qp.stdout){this._stdin=e,this._stdout=t,this._readBuffer=new E3,this._started=!1,this._ondata=n=>{this._readBuffer.appe

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/browser-extension-mcp.jsView on unpkg · L51

dist/filesystem-mcp.mjsView file

3var yE=Object.create;var ql=Object.defineProperty;var _E=Object.getOwnPropertyDescriptor;var $E=Object.getOwnPropertyNames;var xE=Object.getPrototypeOf,bE=Object.prototype.hasOwnPr... L4: `:""},this._extScope=t,this._scope=new qt.Scope({parent:t}),this._nodes=[new am]}toString(){return this._root.render(this.opts)}name(t){return this._scope.name(t)}scopeName(t){retu... L5: || (${a} == "string" && ${n} && ${n} == +${n})`).assign(s,(0,K._)`+${n}`);return;case"integer":o.elseIf((0,K._)`${a} === "boolean" || ${n} === null L6: || (${a} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(s,(0,K._)`+${n}`);return;case"boolean":o.elseIf((0,K._)`${n} === "false" || ${n} === 0 || ${n} === null`).as... L7: || ${a} === "boolean" || ${n} === null`).assign(s,(0,K._)`[${n}]`)}}}function FN

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/filesystem-mcp.mjsView on unpkg · L3

dist/index.jsView file

2Cross-file remote execution chain: dist/index.js spawns dist/browser-extension-mcp.js; helper contains network access plus dynamic code execution. L2: import { createRequire as _createRequire } from 'module'; const require = _createRequire(import.meta.url); L3: var h3=Object.create;var $g=Object.defineProperty;var p3=Object.getOwnPropertyDescriptor;var m3=Object.getOwnPropertyNames;var g3=Object.getPrototypeOf,v3=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+r)}function ji(e,t,r,i,n,o){if(e.listenerCount("wsClientError")){let s=new Error(n);Error.captureStackTrace(s,ji),e.emit("wsClientError",s,r,t)}else sc(r,i,n,o)}});var LO=k((cbe,... L10: \0`,j+=be(z,2),j+=a.magic,j+=be(_,2),j+=be(v,2),j+=be(P.crc32,4),j+=be(P.compressedSize,4),j+=be(P.uncompressedSize,4),j+=be(l.length,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2

2Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/index.js L2: import { createRequire as _createRequire } from 'module'; const require = _createRequire(import.meta.url); L3: var h3=Object.create;var $g=Object.defineProperty;var p3=Object.getOwnPropertyDescriptor;var m3=Object.getOwnPropertyNames;var g3=Object.getPrototypeOf,v3=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+r)}function ji(e,t,r,i,n,o){if(e.listenerCount("wsClientError")){let s=new Error(n);Error.captureStackTrace(s,ji),e.emit("wsClientError",s,r,t)}else sc(r,i,n,o)}});var LO=k((cbe,... L10: \0`,j+=be(z,2),j+=a.magic,j+=be(_,2),j+=be(v,2),j+=be(P.crc32,4),j+=be(P.compressedSize,4),j+=be(P.uncompressedSize,4),j+=be(l.length,2),j+=be(y.length,2);var Ae=cp.LOCAL_FILE_HEAD...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L2

dist/computer-mcp/linux/linux-driver.pyView file

•path = dist/computer-mcp/linux/linux-driver.py kind = build_helper sizeBytes = 41492 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/computer-mcp/linux/linux-driver.pyView on unpkg

dist/browser-extension/assets/index.ts-Bis5r5UE.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/browser-extension/assets/index.ts-Bis5r5UE.js#virtual:normalized:round1View on unpkg

dist/code-mcp/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/code-mcp/index.jsView on unpkg

Source & flagged code

12 flagged · loading source

dist/computer-mcp/dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/computer-mcp/dist/index.jsView on unpkg · L53

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/computer-mcp/dist/index.jsView on unpkg

Findings

10 High4 Medium5 Low

HighChild Processdist/computer-mcp/dist/index.js

HighSame File Env Network Executiondist/browser-extension-mcp.js

HighCommand Output Exfiltrationdist/browser-extension-mcp.js

HighObfuscated Payload Loaderdist/filesystem-mcp.mjs

HighCross File Remote Execution Contextdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighSemantic Analysis Limiteddist/browser-extension/assets/index.ts-Bis5r5UE.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/code-mcp/index.js

HighKnown Malware Source Similaritydist/computer-mcp/dist/index.js

HighKnown Malware Source Similaritydist/browser-extension-mcp.js

Medium

Affected versions and remediation

This report applies to @octavus/agent@1.0.18.

See all versions of @octavus/agent for other recorded verdicts.

Review the evidence and your use of @octavus/agent@1.0.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 04:51:27.483Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.