registry / @vanexalabs-ai/vanexa-agent / 1.3.69

@vanexalabs-ai/vanexa-agent@1.3.69

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed active malicious surface exists in the shipped package. The opaque bytecode is only intended for explicit CLI execution, but the launcher currently fails on a missing relative module before loading it.

Static reason

No blocking static signals were detected.

Trigger

Explicit invocation of vanexa-agent

Impact

No demonstrated runtime impact from this package contents

Mechanism

Broken launcher preceding opaque V8-bytecode load

Rationale

Direct inspection found an opaque payload and concerning claimed capabilities, but no install-time execution or concrete malicious behavior. The sole launcher is broken before the bytecode can load, so the package does not establish an active attack chain.

Evidence

package.jsonbin/vanexa-agent.jsdist/bundle.jscREADME.mdsocket.jsonsocket.ymldist/.v8-version

Decision evidence

public snapshot

AI called this Clean at 83.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/bundle.jsc is a 5.3 MB opaque V8 bytecode payload.
README.md advertises terminal, filesystem, network, and autonomous-agent capabilities.

@vanexalabs-ai/vanexa-agent@1.3.69

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code