@octavus/agent@1.0.2
Octavus Agent CLI - run one of your cloud Octavus Agents on a machine you control, using that machine as the agent's computer. The agent lives in the cloud (fully configured and observable); the local machine only supplies the computer and the trigger.
AI Security Review
scanned 29d ago · by lpm-firewall-aiThe package is a user-invoked computer-use CLI with no install hook, but it also ships a Slack session-token scraper that posts the token to an operator-supplied host. That scraper is not reachable because reportSlackPrefs is never assigned, so the risk is an inert credential-harvest payload rather than an active install-time attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A cloud dispatch with slackPrefsCapture would arm capture only if reportSlackPrefs were also set on the executor config.
Impact
If the missing callback were wired, a Slack session token and user prefs could be sent to an operator-selected endpoint. With the callback unset, that path stays inactive.
Mechanism
The script scans Slack page storage and network calls for an xoxc token, then POSTs that token to users.prefs.get on the supplied host, the page origin, and slack.com.
AI rationale
The package is a user-invoked computer-use CLI with no install hook, but it also ships a Slack session-token scraper that posts the token to an operator-supplied host. That scraper is not reachable because reportSlackPrefs is never assigned, so the risk is an inert credential-harvest payload rather than an active install-time attack.
Evidence
dist/index.js
Network endpoints1
slack.com
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An injected browser script in dist/index.js reads Slack xoxc tokens from localStorage, boot_data, hooked fetch and XHR, and page HTML.
- That token is posted to https:// plus an operator-supplied HOST, the page origin, and https://slack.com on users.prefs.get.
- Capture starts only when a dispatch sets slackPrefsCapture and reportSlackPrefs is configured; this package never assigns reportSlackPrefs, so the scraper stays unwired.
- package.json has no install lifecycle hooks. The octoagent command runs only when the user invokes the CLI.
Evidence against
- The script returns immediately unless the current page hostname is a Slack workspace host.
- The default platform host is https://octavus.ai and credentials are stored under ~/.octavus after an explicit auth command.
- Browser, shell, and filesystem tools match the documented local computer-use CLI.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
13 flagged · loading sourcedist/computer-mcp/dist/index.jsView file
53`);if(e===-1)return null;const t=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),x_(t)}clear(){this._buffer=void 0}};function x_(...
L54: `}var I_=class{constructor(e=_4.stdin,t=_4.stdout){this._stdin=e,this._stdout=t,this._readBuffer=new B_,this._started=!1,this._ondata=u=>{this._readBuffer.append(u),this.processRea...
L55: xcode-select --install`)}return e}function q_(){const e=Qn();if(!Xn(e))throw new Error(`Linux driver not found at ${e}. Ensure linux/linux-driver.py exists.`);try{P_(e,493)}catch{}...
High
Child Process
Package source references child process execution.
dist/computer-mcp/dist/index.jsView on unpkg · L53•matchType = normalized_sha256
matchedPackage = @octavus/agent@1.0.0
matchedPath = dist/computer-mcp/dist/index.js
matchedIdentity = npm:QG9jdGF2dXMvYWdlbnQ:1.0.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/computer-mcp/dist/index.jsView on unpkg5|| (${A} === "string" && ${f} && ${f} == +${f} && !(${f} % 1))`).assign(U,(0,r._)`+${f}`);return;case"boolean":E.elseIf((0,r._)`${f} === "false" || ${f} === 0 || ${f} === null`).as...
L6: || ${A} === "boolean" || ${f} === null`).assign(U,(0,r._)`[${f}]`)}}}function D({gen:p,parentData:_,parentDataProperty:C},E){p.if((0,r._)`${_} !== undefined`,()=>p.assign((0,r._)`$...
L7: missingProperty: ${d},
Findings
1 Critical10 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/computer-mcp/dist/index.js
HighSame File Env Network Executiondist/browser-extension-mcp.js
HighCommand Output Exfiltrationdist/browser-extension-mcp.js
HighObfuscated Payload Loaderdist/filesystem-mcp.mjs
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/browser-extension/assets/index.ts-Bis5r5UE.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/computer-mcp/dist/index.js
Affected versions and remediation
This report applies to @octavus/agent@1.0.2.
See all versions of @octavus/agent for other recorded verdicts.
- Review the evidence and your use of @octavus/agent@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.