registry / Staged payload carrier / @vanexalabs-ai/vanexa-agent / 1.8.0

@vanexalabs-ai/vanexa-agent@1.8.0

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an opaque remote-agent payload with broad stated capabilities and security-scanner suppression, creating unresolved dangerous capability risk. No lifecycle hook or concrete malicious send/destructive action was established.

Static reason

No blocking static signals were detected.

Trigger

A user runs the vanexa-agent command after installation.

Impact

The opaque payload could execute commands and access project files; static source inspection cannot verify effective authorization or network restrictions.

Mechanism

Runtime loading of opaque bytecode for a remote command-and-file agent.

AI rationale

Evidence

bin/vanexa-agent.jsdist/bundle.jscsocket.jsonsocket.yml

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The command entrypoint loads a bundled V8 bytecode file at runtime, leaving its executable behavior opaque to source review.
The bytecode contains a relay identifier, while the included source cannot establish endpoint validation or command authorization.
The package’s Socket configuration suppresses shell, filesystem, network, obfuscation, and native-code findings.
The shipped scanner configuration discusses malware detection and how security scanning should interpret the package; this is reviewer manipulation under policy.
The README describes a headless remote-control daemon that executes terminal commands and modifies files.

Evidence against

The manifest has no preinstall, install, or postinstall hook; its only publish-related hook is prepublishOnly.
No self-dependency is declared.
This snapshot lacks the src path imported by the launcher, so the command appears to fail before loading bytecode.
Static inspection did not establish a credential-exfiltration sink or a concrete destructive action.

Behavioral surface

Source

Source & flagged code

7 flagged

bin/vanexa-agent.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * VANEXA AGENT - Sovereign Digital Brain

4 * V8 Bytecode Launcher with Runtime Version Guard

5 */

6import path from 'path';

7import fs from 'fs';

8import { fileURLToPath } from 'url';

9import v8 from 'v8';

10import bytenode from 'bytenode';

11import { createRequire } from 'module';

12import { UI } from '../src/utils/cli_ui.js';

14const require = createRequire(import.meta.url);

15const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L13

16const __dirname = path.dirname(__filename);

18// ── V8 Version Guard ──

19// V8 bytecode is NOT portable across V8 engine versions.

20// The .jsc file MUST be loaded by the same V8 major version that compiled it.

21const REQUIRED_NODE_MAJOR = 24;

22const userNodeMajor = parseInt(process.versions.node.split('.')[0], 10);

24if (userNodeMajor < REQUIRED_NODE_MAJOR) {

25 UI.printFatalBox('FATAL: Node.js Version Mismatch', [

26 `Your Node.js: v${process.versions.node} (V8 ${process.versions.v8})`,

27 `Required: v${REQUIRED_NODE_MAJOR}.x LTS or higher`,

28 ``,

29 `Vanexa Agent uses V8 bytecode compiled for Node.js v24 LTS.`,

30 `The bytecode is incompatible with older Node.js versions.`,

31 ``,

32 `➤ Fix: Install Node.js v24 LTS from https://nodejs.org`,

33 ``,

Lines 69-109javascript

69 } catch (e) {

70 console.error('⚠ Auto-compile warning:', e.message);

71 return false;

72 }

73 }

74 return false;

75}

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 4016120 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

113vanexa-agent-relay

Medium

Stripped Provenance Metadata

The bytecode contains a relay identifier, while the included source cannot establish endpoint validation or command authorization.

dist/bundle.jscView on unpkg · L113

socket.jsonView file

Lines 1-15json

2 "$schema": "https://socket.dev/config/v0.json",

3 "$comment": "Vanexa Agent declares only the capabilities it genuinely needs and suppresses nothing else. A previous wildcard packageRules block silenced every category for every transitive dependency; Amazon Inspector cited that file as evidence of concealment in MAL-2026-13397. Malware-intent detectors (aiMalware, gptMalware, usesEval, bypassesEnvironment, installScripts, typosquat) are deliberately LEFT ENABLED so their verdicts stay meaningful. Per-rule justifications are in socket.yml (shipped) and, in the public source repository, in SECURITY.md and docs/INFRASTRUCTURE.md, which enumera ...

4 "version": 2,

5 "project": "

socket.ymlView file

Lines 1-26yaml

1# ─────────────────────────────────────────────────────────────────────────────

2# Socket.dev configuration for @vanexalabs-ai/vanexa-agent

4# WHY THIS FILE LOOKS THE WAY IT DOES — read before editing.

6# Earlier releases carried a wildcard `packageRules` block that set every issue

7# category to `ignore` for every package by wildcard — every transitive dependency,

8# every rule.

9# Amazon Inspector cited exactly that in advisory MAL-2026-13397:

10#

README.mdView file

Lines 60-100markdown

60│ │ Direct Encrypted Tunnel │ │

61│ • Task Input │ No Server in the Middle │ • AgentLoop (Brain) │

62│ • Live Monitoring │ │ • 64+ Tools (Hands) │

63│ • Config Sync │ ┌──────────────┐ │ • 4-Layer Sandbox │

64│ • Kill Switch │ │ ☁️ Signaling │ │ • Cortex Memory │

65│ • Approval UI │ │ (5 sec only) │ │ • 10 LLM Providers │

66└──────────────────────┘ └──────────────┘ └───────────────────────┘

67```

691. **You type** a task on your phone (e.g., "Build me a portfolio website")

Source & flagged code

7 flagged · loading source

bin/vanexa-agent.jsView file

13L14: const require = createRequire(import.meta.url); L15: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L13

89function loadAgentBrain() { try { // Execute the protected proprietary brain require(bytecodePath);

Medium

Ai Review Evidence

The command entrypoint loads a bundled V8 bytecode file at runtime, leaving its executable behavior opaque to source review.

bin/vanexa-agent.jsView on unpkg · L89

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 4016120 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

Findings

1 High6 Medium4 Low

HighShips Node Bytecodedist/bundle.jsc

MediumDynamic Requirebin/vanexa-agent.js

MediumAi Review Evidencebin/vanexa-agent.js

MediumStripped Provenance Metadatadist/bundle.jsc

MediumAi Review Evidencesocket.json

MediumAi Review Evidencesocket.yml

MediumAi Review EvidenceREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @vanexalabs-ai/vanexa-agent@1.8.0.

See all versions of @vanexalabs-ai/vanexa-agent for other recorded verdicts.

Review the evidence and your use of @vanexalabs-ai/vanexa-agent@1.8.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 12:41:08.602Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code