@vanexalabs-ai/vanexa-agent@1.3.72: Suspicious npm security | LPM Firewall

Loading npm security reports…

@vanexalabs-ai/vanexa-agent@1.3.72: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

bin/vanexa-agent.jsView file

13L14: const require = createRequire(import.meta.url); L15: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L13

44const bytecodePath = path.join(__dirname, '../dist/bundle.jsc'); const cjsPath = path.join(__dirname, '../dist/bundle.cjs');

Medium

Ai Review Evidence

CLI executes an opaque 3.6 MB V8 bytecode bundle.

bin/vanexa-agent.jsView on unpkg · L44

89function loadAgentBrain() { try { // Execute the protected proprietary brain require(bytecodePath);

Medium

Ai Review Evidence

CLI executes an opaque 3.6 MB V8 bytecode bundle.

bin/vanexa-agent.jsView on unpkg · L89

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 3798400 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

README.mdView file

84| **Terminal** | Execute commands, run background processes, maintain persistent shell sessions (stateful REPL) | | **File System** | Read, write, edit (surgical search/replace), multi-edit, search (regex grep), find (glob), list, move, delete | | **Code Intelligence** | Syntax verification, symbol listing, AST search, Ripgrep-powered code search, semantic codebase search | | **Git** | Full git operations with risk-mapped approval gates | | **Web** | Fetch URLs (with SSRF protection), DuckDuckGo + Google web search | | **Desktop Automation** | Browser automation (Puppeteer-like), desktop

Medium

Ai Review Evidence

Documentation describes autonomous shell, filesystem, web, browser, and persistent tool-creation capabilities.

README.mdView on unpkg · L84

socket.jsonView file

5"issueRules": { "aiMalware": "ignore", "gptMalware": "ignore", "obfuscatedCode": "ignore", "obfuscatedFile": "ignore", "usesEval": "ignore", "nativeCode": "ignore", "shellAccess": "ignore", "filesystemAccess": "ignore", "networkAccess": "ignore", "bypassesEnvironment": "ignore", "installScripts": "ignore", "socketOverride": "ignore", "socketOptimizedOverride": "ignore",

Medium

Ai Review Evidence

Bundled Socket policy suppresses malware, obfuscation, shell, filesystem, and network findings.

socket.jsonView on unpkg · L5

Source & flagged code

6 flagged

bin/vanexa-agent.jsView file

Lines 1-109javascript

1#!/usr/bin/env node

2/**

3 * VANEXA AGENT - Sovereign Digital Brain

4 * V8 Bytecode Launcher with Runtime Version Guard

5 */

6import path from 'path';

7import fs from 'fs';

8import { fileURLToPath } from 'url';

9import v8 from 'v8';

10import bytenode from 'bytenode';

11import { createRequire } from 'module';

12import { UI } from '../src/utils/cli_ui.js';

13

14const require = createRequire(import.meta.url);

15const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L13

16const __dirname = path.dirname(__filename);

17

18// ── V8 Version Guard ──

19// V8 bytecode is NOT portable across V8 engine versions.

20// The .jsc file MUST be loaded by the same V8 major version that compiled it.

21const REQUIRED_NODE_MAJOR = 24;

22const userNodeMajor = parseInt(process.versions.node.split('.')[0], 10);

23

24if (userNodeMajor < REQUIRED_NODE_MAJOR) {

25 UI.printFatalBox('FATAL: Node.js Version Mismatch', [

26 `Your Node.js: v${process.versions.node} (V8 ${process.versions.v8})`,

27 `Required: v${REQUIRED_NODE_MAJOR}.x LTS or higher`,

28 ``,

29 `Vanexa Agent uses V8 bytecode compiled for Node.js v24 LTS.`,

30 `The bytecode is incompatible with older Node.js versions.`,

31 ``,

32 `➤ Fix: Install Node.js v24 LTS from https://nodejs.org`,

33 ``,

34 `Quick install commands:`,

35 ` macOS/Linux: nvm install 24 && nvm use 24`,

36 ` Windows: winget install OpenJS.NodeJS.LTS`

37 ]);

38 process.exit(1);

39}

40

41// Optimize V8 memory flag for bytecode execution

42v8.setFlagsFromString('--no-flush-bytecode');

43

44const bytecodePath = path.join(__dirname, '../dist/bundle.jsc');

45const cjsPath = path.join(__dirname, '../dist/bundle.cjs');

Medium

Ai Review Evidence

CLI executes an opaque 3.6 MB V8 bytecode bundle.

bin/vanexa-agent.jsView on unpkg · L44

46

47// Helper function to recompile local bytecode when V8 engine differs or .jsc is missing

48function tryAutoCompileBytecode() {

49 if (fs.existsSync(cjsPath)) {

50 console.log('⚡ V8 engine adaptation or upgrade detected.');

51 console.log(` Optimizing local V8 bytecode for Node.js v${process.versions.node} (V8 ${process.versions.v8})...`);

52 try {

53 bytenode.compileFile({

54 filename: cjsPath,

55 output: bytecodePath

56 });

57 const stampPath = path.join(__dirname, '../dist/.v8-version');

58 const stampContent = [

59 `node=${process.versions.node}`,

60 `v8=${process.versions.v8}`,

61 `platform=${process.platform}`,

62 `arch=${process.arch}`,

63 `compiled=${new Date().toISOString()}`,

64 `required_node_major=24`

69 } catch (e) {

70 console.error('⚠ Auto-compile warning:', e.message);

71 return false;

72 }

73 }

74 return false;

75}

76

77// Check if bytecode file exists, if not try to auto compile

78if (!fs.existsSync(bytecodePath)) {

79 if (!tryAutoCompileBytecode() || !fs.existsSync(bytecodePath)) {

80 UI.printFatalBox('FATAL: Bytecode file not found', [

81 `File missing at: ${bytecodePath}`,

82 `The package may be corrupted.`,

83 `Try: npm install -g @vanexalabs-ai/vanexa-agent@latest`

84 ]);

85 process.exit(1);

86 }

87}

88

89function loadAgentBrain() {

90 try {

91 // Execute the protected proprietary brain

92 require(bytecodePath);

Medium

Ai Review Evidence

CLI executes an opaque 3.6 MB V8 bytecode bundle.

bin/vanexa-agent.jsView on unpkg · L89

93 } catch (error) {

94 const isBytecodeMismatch = error && error.message && (

95 error.message.includes('cachedDataRejected') ||

96 error.message.includes('Invalid bytecode') ||

97 error.message.includes('bytecode') ||

98 error.message.includes('Invalid or incompatible') ||

99 error.message.includes('bad bytecode')

100 );

101

102 if (isBytecodeMismatch) {

103 if (tryAutoCompileBytecode() && fs.existsSync(bytecodePath)) {

104 try {

105 delete require.cache[require.resolve(bytecodePath)];

106 require(bytecodePath);

107 return;

108 } catch (retryError) {

109 error = retryError;

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 3798400 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

README.mdView file

Lines 64-104markdown

64│ • Kill Switch │ │ ☁️ Signaling │ │ • Cortex Memory │

65│ • Approval UI │ │ (5 sec only) │ │ • 10 LLM Providers │

66└──────────────────────┘ └──────────────┘ └───────────────────────┘

67```

68

691. **You type** a task on your phone (e.g., "Build me a portfolio website")

702. **A 5-second handshake** establishes a direct encrypted tunnel between your phone and computer — then the signaling server disconnects. **No middleman.**

713. **The AgentLoop** on your computer plans the task, calls your chosen LLM, and autonomously executes tools in a Plan → Act → Observe → Reflect loop

724. **You monitor** every step in real-time on your phone, and approve or deny dangerous operations

socket.jsonView file

Lines 1-25json

1{

2 "$schema": "https://socket.dev/config/v0.json",

3 "version": 2,

4 "project": "@vanexalabs-ai/vanexa-agent",

5 "issueRules": {

6 "aiMalware"