registry / @octavus/agent / 1.0.34

@octavus/agent@1.0.34

Octavus Agent CLI - run one of your cloud Octavus Agents on a machine you control, using that machine as the agent's computer. The agent lives in the cloud (fully configured and observable); the local machine only supplies the computer and the trigger.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Source inspection found no install hooks. The flagged agent-instruction helper has no invocation in the bundled entrypoint, while the active CLI and local tools support the package's stated user-run cloud-agent function.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the CLI with a prompt after configuring a platform and API key.

Impact

The inspected behavior matches the package's stated purpose, and no independent credential theft, stealth execution, or unauthorized mutation was established.

Mechanism

The CLI starts a session at the configured platform and provides local computer, file, and browser tools; the browser extension bridge uses loopback.

AI rationale

Evidence

package.jsondist/index.jsdist/computer-mcp/dist/index.jsdist/filesystem-mcp.mjsdist/browser-extension-mcp.jsdist/code-mcp/index.jsdist/browser-extension/assets/index.ts-bRX4RyXJ.js

Network endpoints2

octavus.ai127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes an Octavus command-line tool and defines no npm lifecycle scripts.
A run requires a configured platform and API key, then sends the caller's prompt to the configured session endpoint; the production default is Octavus's own service.
The flagged helper collects workspace instructions, but a search of the bundled entrypoint found no invocation of that helper.
The runtime tools provide the expected local computer, workspace file, and browser functions; file writes are limited to allowed directories, and the browser extension bridge binds to loopback.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

Source & flagged code

9 flagged

dist/computer-mcp/dist/index.jsView file

54`);if(e===-1)return null;const t=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),N_(t)}clear(){this._buffer=void 0}};function N_(... L55: `}var Z_=class{constructor(e=y4.stdin,t=y4.stdout,u){this._stdin=e,this._stdout=t,this._started=!1,this._ondata=n=>{try{this._readBuffer.append(n),this.processReadBuffer()}catch(r)... L56: xcode-select --install`)}return e}function Q_(){const e=Qn();if(!Xn(e))throw new Error(`Linux driver not found at ${e}. Ensure linux/linux-driver.py exists.`);try{V_(e,493)}catch{}...

High

Child Process

Package source references child process execution.

dist/computer-mcp/dist/index.jsView on unpkg · L54

5|| (${T} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(L,(0,r._)`+${g}`);return;case"boolean":C.elseIf((0,r._)`${g} === "false" || ${g} === 0 || ${g} === null`).as... L6: || ${T} === "boolean" || ${g} === null`).assign(L,(0,r._)`[${g}]`)}}}function _({gen:y,parentData:$,parentDataProperty:A},C){y.if((0,r._)`${$} !== undefined`,()=>y.assign((0,r._)`$... L7: missingProperty: ${m},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/computer-mcp/dist/index.jsView on unpkg · L5

dist/browser-extension-mcp.jsView file

5|| (${C} === "string" && ${m} && ${m} == +${m} && !(${m} % 1))`).assign(F,(0,r._)`+${m}`);return;case"boolean":y.elseIf((0,r._)`${m} === "false" || ${m} === 0 || ${m} === null`).as... L6: || ${C} === "boolean" || ${m} === null`).assign(F,(0,r._)`[${m}]`)}}}function h({gen:g,parentData:S,parentDataProperty:B},y){g.if((0,r._)`${S} !== undefined`,()=>g.assign((0,r._)`$... L7: missingProperty: ${f}, L8: depsCount: ${c}, L9: deps: ${l}}`};var r={keyword:"dependencies",type:"object",schemaType:"object",error:e.error,code(s){const[c,l]=i(s);a(s,c),o(s,l)}};function i({schema:s}){const c={},l={};for(const... L10: `).join(`\r

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/browser-extension-mcp.jsView on unpkg · L5

51L52: `)}h.write("payload.value = newResult;"),h.write("return payload;");const b=h.compile();return(g,S)=>b(_,g,S)};let i;const a=br,o=!iu.jitless,c=o&&_0.value,l=t.catchall;let f;e._zo... L53: L54: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(const a of e.seen.entries()){const o=a[1];if(t===a[0]){i(a);continue}if(e.external){const c=e... L55: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function $_(e){return e.description}function ... ... L60: `);if(e===-1)return null;const t=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),k3(t)}clear(){this._buffer=void 0}};function k3(... L61: `}var B3=class{construc

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/browser-extension-mcp.jsView on unpkg · L51

dist/filesystem-mcp.mjsView file

3var CE=Object.create;var Wl=Object.defineProperty;var UE=Object.getOwnPropertyDescriptor;var ME=Object.getOwnPropertyNames;var LE=Object.getPrototypeOf,FE=Object.prototype.hasOwnPr... L4: `:""},this._extScope=t,this._scope=new Vt.Scope({parent:t}),this._nodes=[new dm]}toString(){return this._root.render(this.opts)}name(t){return this._scope.name(t)}scopeName(t){retu... L5: || (${a} == "string" && ${n} && ${n} == +${n})`).assign(s,(0,K._)`+${n}`);return;case"integer":o.elseIf((0,K._)`${a} === "boolean" || ${n} === null L6: || (${a} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(s,(0,K._)`+${n}`);return;case"boolean":o.elseIf((0,K._)`${n} === "false" || ${n} === 0 || ${n} === null`).as... L7: || ${a} === "boolean" || ${n} === null`).assign(s,(0,K._)`[${n}]`)}}}function uR

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/filesystem-mcp.mjsView on unpkg · L3

dist/index.jsView file

2Cross-file remote execution chain: dist/index.js spawns dist/browser-extension-mcp.js; helper contains network access plus dynamic code execution. L2: import { createRequire as _createRequire } from 'module'; const require = _createRequire(import.meta.url); L3: var gB=Object.create;var ng=Object.defineProperty;var vB=Object.getOwnPropertyDescriptor;var yB=Object.getOwnPropertyNames;var _B=Object.getPrototypeOf,bB=Object.prototype.hasOwnPr... L4: `).join(`\r ... L12: `?0:1:P!==" "&&P!==" "&&P!==` L13: `&&(v+=1)}}else m+=T}}if(_)return{op:"glob",pattern:m};if(n){if(v!==null&&v>0){g[g.length]=m,m="";for(var j=1;j<v;j+=1)g[g.length]=""}return(m!==""||y&&g.length===0)&&(g[g.length]=... L14: \0`,j+=xe(I,2),j+=a.magic,j+=xe(y,2),j+=xe(v,2),j+=xe(R.crc32,4),j+=xe(R.compressedSize,4),j+=xe(R.uncomp

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2

2Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/index.js L2: import { createRequire as _createRequire } from 'module'; const require = _createRequire(import.meta.url); L3: var gB=Object.create;var ng=Object.defineProperty;var vB=Object.getOwnPropertyDescriptor;var yB=Object.getOwnPropertyNames;var _B=Object.getPrototypeOf,bB=Object.prototype.hasOwnPr... L4: `).join(`\r ... L12: `?0:1:P!==" "&&P!==" "&&P!==` L13: `&&(v+=1)}}else m+=T}}if(_)return{op:"glob",pattern:m};if(n){if(v!==null&&v>0){g[g.length]=m,m="";for(var j=1;j<v;j+=1)g[g.length]=""}return(m!==""||y&&g.length===0)&&(g[g.length]=... L14: \0`,j+=xe(I,2),j+=a.magic,j+=xe(y,2),j+=xe(v,2),j+=xe(R.crc32,4),j+=xe(R.compressedSize,4),j+=xe(R.uncompressedSize,4),j+=xe(l.length,2),j+=xe(_.length,2);var J=Vh.LOCAL

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L2

dist/computer-mcp/linux/linux-driver.pyView file

•path = dist/computer-mcp/linux/linux-driver.py kind = build_helper sizeBytes = 87332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/computer-mcp/linux/linux-driver.pyView on unpkg

dist/browser-extension/assets/index.ts-bRX4RyXJ.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/browser-extension/assets/index.ts-bRX4RyXJ.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

dist/computer-mcp/dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/computer-mcp/dist/index.jsView on unpkg · L54

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/computer-mcp/dist/index.jsView on unpkg · L5

dist/browser-extension-mcp.js

Findings

7 High4 Medium5 Low

HighChild Processdist/computer-mcp/dist/index.js

HighSame File Env Network Executiondist/browser-extension-mcp.js

HighCommand Output Exfiltrationdist/browser-extension-mcp.js

HighObfuscated Payload Loaderdist/filesystem-mcp.mjs

HighCross File Remote Execution Contextdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighSemantic Analysis Limiteddist/browser-extension/assets/index.ts-bRX4RyXJ.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/computer-mcp/linux/linux-driver.py

MediumStructural Risk Force Deep Review

LowEvaldist/computer-mcp/dist/index.js

Affected versions and remediation

This report applies to @octavus/agent@1.0.34.

See all versions of @octavus/agent for other recorded verdicts.

Review the evidence and your use of @octavus/agent@1.0.34 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 06:35:01.414Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.