registry / @vanexalabs-ai/vanexa-agent / 1.3.68

@vanexalabs-ai/vanexa-agent@1.3.68

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs vanexa-agent after installation.

Impact

If made runnable, remote tasks could execute commands and modify user files; the hidden payload prevents complete source verification.

Mechanism

Opaque bytecode-backed remote AI daemon with shell, relay, and update capabilities.

Rationale

This is an opaque, high-capability payload with real remote-control primitives, but source evidence does not prove malicious behavior. Warn rather than block because no install hook or concrete malicious chain was found.

Evidence

package.jsonbin/vanexa-agent.jsdist/bundle.jscsocket.jsonsocket.ymldist/.v8-versionsrc/utils/cli_ui.js

Network endpoints1

vanexa-agent-relay.workers.dev

Decision evidence

public snapshot

AI called this at 86.0% confidence with false-positive risk.

@vanexalabs-ai/vanexa-agent@1.3.68

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code