registry / @vanexalabs-ai/vanexa-agent / 1.3.64

@vanexalabs-ai/vanexa-agent@1.3.64

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs vanexa-agent or invokes its CLI commands.

Impact

A paired remote client or user task could exercise high-privilege local automation.

Mechanism

Opaque bytecode agent with shell, filesystem, browser, and network capabilities.

Rationale

The package is not proven malicious, but its intentionally opaque runtime payload and broad remote-agent capabilities prevent a clean verdict. Treat as a warning for dangerous capability pending auditable source.

Evidence

package.jsonbin/vanexa-agent.jsdist/bundle.jscsocket.jsonREADME.mddist/.v8-version

Network endpoints3

vanexa-agent-relay.workers.devapi.openai.com/v1/images/generationsapi.openai.com/v1/video/generations

Decision evidence

public snapshot

@vanexalabs-ai/vanexa-agent@1.3.64

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code