@vanexalabs-ai/vanexa-agent@1.3.60: Malicious npm security report | LPM Firewall

Loading npm security reports…

@vanexalabs-ai/vanexa-agent@1.3.60: Malicious npm security report | LPM Firewall

Source & flagged code

14 flagged · loading source

dist/bundle.cjsView file

39`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function ale(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5... L40: `);return s!==-1&&(e=Wze(e,n,i,s)),i+e+n},UU,ple=(r,...e)=>{let[t]=e;if(!I3(t)||!I3(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String... L41: `))this.lineCount+=Math.max(1,Math.ceil(lXe(i)/e))}get isEnabled(){return this._isEnabled&&!this.isSilent}set isEnabled(e){if(typeof e!="boolean")throw new TypeError("The `isEnable... ... L47: \v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L48: \v\f\r\x1B !"#$%&'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/bundle.cjsView on unpkg · L39

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/bundle.cjsView on unpkg · L1

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bundle.cjsView on unpkg · L1

211${i("Argument: %s, Given: %s, Choices: %s",b,e.stringifiedValues(p[b]),e.stringifiedValues(f.choices[b]))}`}),e.fail(g)};let o={};s.implies=function(d,f){Ft("<string|object> [array... L212: `;f.forEach(m=>{p+=m}),e.fail(p)}};let c={};s.conflicts=function(d,f){Ft("<string|object> [array|string]",[d,f],arguments.length),typeof d=="object"?Object.keys(d).forEach(p=>{s.co... L213: `),void 0,"versionWarning"),F(this,Kt,"f").key[e]=!0,t.alias&&this.alias(e,t.alias);let i=t.deprecate||t.deprecated;i&&this.deprecateOption(e,i);let n=t.demand||t.required||t.requi... L214: `,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")},error:(...e)=>{this[pB]()||console.error(...e),Nt(this,xa,!0,"f"),F(this,ds,"f").length&&Nt(this,ds,F(this,ds,"f")+` L215: `,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")}

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle.cjsView on unpkg · L211

•context = lace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#r("destroy",...e)}destroySoon(...e){return this.#r("destroySoon",...e)}close(...e){return this.#r("close",...e)}};ahe.exports=J$});function N8(){qs.default.existsSync(HS)||qs.default.mkdirSync(HS,{recursive:!0,mode:448})}function yhe(){if(N8(),!qs.default.existsSync(Z$)){let r=Hm.default.randomBytes(32);return qs.default.writeFileSync(Z$,r,{mode:384}),r}return qs.default.readFileSync(Z$)}function bhe(r){if(!r||r.startsWith("ENC:"))return r;let e=yhe(),t=Hm.default.randomBytes(16),i=Hm.default.createCipheriv("aes-256-gcm",e,t),n=i.update(r,"utf8","hex");n+=i.final("hex");let s=i.getAuthT

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundle.cjsView on unpkg

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(...

High

Child Process

Package source references child process execution.

dist/bundle.cjsView on unpkg · L9

33`,n)}while(i!==-1);return s+=r.substr(n),s};Aue.exports={stringReplaceAll:xze,stringEncaseCRLFWithFirstIndex:vze}});var Oue=S((H1t,Iue)=>{"use strict";var wze=/(?:\\(u(?:[a-f\d]{4}... L34: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Pue(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5... L35: `);return s!==-1&&(e=kze(e,n,i,s)),i+e+n},OU,Nue=(r,...e)=>{let[t]=e;if(!x3(t)||!x3(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String... L36: `:` ... L39: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function ale(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5... L40: `);return s!==-1&&(e=Wze(e

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle.cjsView on unpkg · L33

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

dist/bundle.cjsView on unpkg · L1

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bundle.cjsView on unpkg · L1

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(... ... L42: `),this)}stop(){return this.isEnabled?(clearInterval(this.id),this.id=void 0,this.frameIndex=0,this.clear(),this.hideCursor&&Ude.show(this.stream),this.discardStdin&&process.stdin.... L43: `),this}},mXe=function(r){return new t8(r)};Dq.exports=mXe;Dq.exports.promise=(r,e)=>{if(typeof r.then!="function")throw new TypeError("Parameter `action` must be a

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bundle.cjsView on unpkg · L9

214`,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")},error:(...e)=>{this[pB]()||console.error(...e),Nt(this,xa,!0,"f"),F(this,ds,"f").length&&Nt(this,ds,F(this,ds,"f")+` L215: `,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")}}}[Rz](e){Vv(F(this,Kt,"f")).forEach(t=>{if((n=>n==="configObjects")(t))return;let i=F(this,Kt,"f")[t];Array.isArray(i)?i.includes... L216: `).map(J=>J.trim()).filter(J=>!!J);if(!g||!b)throw new Error(`Invalid DevToolsActivePort '${m}' found`);let w=parseInt(g,10);if(isNaN(w)||w<=0||w>65535)throw new Error(`Invalid por... L217: `);throw Ae.includes("Failed to create a ProcessSingleton for your profile directory")||process.platform==="win32"&&(0,uE.existsSync)((0,eG.join)(K.userDataDir,"lockfile"))?new Err... L218: 1. you did not perform an installation before runn

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.cjsView on unpkg · L214

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bundle.cjsView on unpkg · L1

bin/vanexa-agent.jsView file

13L14: const require = createRequire(import.meta.url); L15: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L13

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 8403952 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

Source & flagged code

14 flagged

dist/bundle.cjsView file

39`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function ale(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5... L40: `);return s!==-1&&(e=Wze(e,n,i,s)),i+e+n},UU,ple=(r,...e)=>{let[t]=e;if(!I3(t)||!I3(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String... L41: `))this.lineCount+=Math.max(1,Math.ceil(lXe(i)/e))}get isEnabled(){return this._isEnabled&&!this.isSilent}set isEnabled(e){if(typeof e!="boolean")throw new TypeError("The `isEnable... ... L47: \v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L48: \v\f\r\x1B !"#$%&'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/bundle.cjsView on unpkg · L39

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/bundle.cjsView on unpkg · L1

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bundle.cjsView on unpkg · L1

211${i("Argument: %s, Given: %s, Choices: %s",b,e.stringifiedValues(p[b]),e.stringifiedValues(f.choices[b]))}`}),e.fail(g)};let o={};s.implies=function(d,f){Ft("<string|object> [array... L212: `;f.forEach(m=>{p+=m}),e.fail(p)}};let c={};s.conflicts=function(d,f){Ft("<string|object> [array|string]",[d,f],arguments.length),typeof d=="object"?Object.keys(d).forEach(p=>{s.co... L213: `),void 0,"versionWarning"),F(this,Kt,"f").key[e]=!0,t.alias&&this.alias(e,t.alias);let i=t.deprecate||t.deprecated;i&&this.deprecateOption(e,i);let n=t.demand||t.required||t.requi... L214: `,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")},error:(...e)=>{this[pB]()||console.error(...e),Nt(this,xa,!0,"f"),F(this,ds,"f").length&&Nt(this,ds,F(this,ds,"f")+` L215: `,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")}

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle.cjsView on unpkg · L211

•context = lace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#r("destroy",...e)}destroySoon(...e){return this.#r("destroySoon",...e)}close(...e){return this.#r("close",...e)}};ahe.exports=J$});function N8(){qs.default.existsSync(HS)||qs.default.mkdirSync(HS,{recursive:!0,mode:448})}function yhe(){if(N8(),!qs.default.existsSync(Z$)){let r=Hm.default.randomBytes(32);return qs.default.writeFileSync(Z$,r,{mode:384}),r}return qs.default.readFileSync(Z$)}function bhe(r){if(!r||r.startsWith("ENC:"))return r;let e=yhe(),t=Hm.default.randomBytes(16),i=Hm.default.createCipheriv("aes-256-gcm",e,t),n=i.update(r,"utf8","hex");n+=i.final("hex");let s=i.getAuthT

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundle.cjsView on unpkg

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(...

High

Child Process

Package source references child process execution.

dist/bundle.cjsView on unpkg · L9

33`,n)}while(i!==-1);return s+=r.substr(n),s};Aue.exports={stringReplaceAll:xze,stringEncaseCRLFWithFirstIndex:vze}});var Oue=S((H1t,Iue)=>{"use strict";var wze=/(?:\\(u(?:[a-f\d]{4}... L34: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Pue(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5... L35: `);return s!==-1&&(e=kze(e,n,i,s)),i+e+n},OU,Nue=(r,...e)=>{let[t]=e;if(!x3(t)||!x3(t.raw))return e.join(" ");let i=e.slice(1),n=[t.raw[0]];for(let s=1;s<t.length;s++)n.push(String... L36: `:` ... L39: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function ale(r){let e=r[0]==="u",t=r[1]==="{";return e&&!t&&r.length===5... L40: `);return s!==-1&&(e=Wze(e

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle.cjsView on unpkg · L33

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

dist/bundle.cjsView on unpkg · L1

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bundle.cjsView on unpkg · L1

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.commands.push(... ... L42: `),this)}stop(){return this.isEnabled?(clearInterval(this.id),this.id=void 0,this.frameIndex=0,this.clear(),this.hideCursor&&Ude.show(this.stream),this.discardStdin&&process.stdin.... L43: `),this}},mXe=function(r){return new t8(r)};Dq.exports=mXe;Dq.exports.promise=(r,e)=>{if(typeof r.then!="function")throw new TypeError("Parameter `action` must be a

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bundle.cjsView on unpkg · L9

214`,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")},error:(...e)=>{this[pB]()||console.error(...e),Nt(this,xa,!0,"f"),F(this,ds,"f").length&&Nt(this,ds,F(this,ds,"f")+` L215: `,"f"),Nt(this,ds,F(this,ds,"f")+e.join(" "),"f")}}}[Rz](e){Vv(F(this,Kt,"f")).forEach(t=>{if((n=>n==="configObjects")(t))return;let i=F(this,Kt,"f")[t];Array.isArray(i)?i.includes... L216: `).map(J=>J.trim()).filter(J=>!!J);if(!g||!b)throw new Error(`Invalid DevToolsActivePort '${m}' found`);let w=parseInt(g,10);if(isNaN(w)||w<=0||w>65535)throw new Error(`Invalid por... L217: `);throw Ae.includes("Failed to create a ProcessSingleton for your profile directory")||process.platform==="win32"&&(0,uE.existsSync)((0,eG.join)(K.userDataDir,"lockfile"))?new Err... L218: 1. you did not perform an installation before runn

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.cjsView on unpkg · L214

1var c4e=Object.create;var tT=Object.defineProperty;var u4e=Object.getOwnPropertyDescriptor;var l4e=Object.getOwnPropertyNames;var d4e=Object.getPrototypeOf,f4e=Object.prototype.has... L2: `).replace(/^/gm," ".repeat(s))}let u=[`Usage: ${t.commandUsage(e)}`,""],l=t.commandDescription(e);l.length>0&&(u=u.concat([t.wrap(l,n,0),""]));let d=t.visibleArguments(e).map(m=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}rne.suggestSimilar=x4e});var une=S(cne=>{var v4e=require("events").EventEmitter,rj=require("child_process"),Ql=require("path"),ij=require("fs"),Ji=requi... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this.c

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bundle.cjsView on unpkg · L1

bin/vanexa-agent.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * VANEXA AGENT - Sovereign Digital Brain

4 * V8 Bytecode Launcher with Runtime Version Guard

5 */

6import path from 'path';

7import fs from 'fs';

8import

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 8403952 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg