registry / @vanexalabs-ai/vanexa-agent / 1.3.63

@vanexalabs-ai/vanexa-agent@1.3.63

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs vanexa-agent (for example pair, start, run, or exec).

Impact

A paired controller can direct powerful local automation and shell actions.

Mechanism

Opaque bytecode-backed remote AI-agent command execution.

Rationale

No concrete malware behavior was established, so a publish block is not warranted. The executable opaque payload and powerful remote-control capability leave a real unresolved security risk.

Evidence

package.jsonbin/vanexa-agent.jsdist/bundle.jscREADME.mdsocket.jsonsocket.ymldist/.v8-version

Network endpoints1

vanexa-agent-relay.workers.dev

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

@vanexalabs-ai/vanexa-agent@1.3.63

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code