registry / @vanexalabs-ai/vanexa-agent / 1.3.65

@vanexalabs-ai/vanexa-agent@1.3.65

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs vanexa-agent or its installed CLI command.

Impact

A paired user session could authorize broad local actions and outbound requests.

Mechanism

Opaque V8 bytecode executes a remote-controlled autonomous-agent runtime.

Rationale

The package is not proven malicious, but its sole substantive implementation is opaque bytecode containing powerful local-agent primitives. A warning is warranted because those capabilities cannot be fully source-audited.

Evidence

package.jsonbin/vanexa-agent.jsdist/bundle.jscsocket.jsonREADME.mddist/.v8-version

Network endpoints3

vanexa-agent-relay.workers.devapi.openai.com/v1/chat/completionsapi.anthropic.com/v1/messages

Decision evidence

public snapshot

@vanexalabs-ai/vanexa-agent@1.3.65

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code