registry / @vanexalabs-ai/vanexa-agent / 1.8.1

@vanexalabs-ai/vanexa-agent@1.8.1

⚠ Under review

Sovereign AI Agent Desktop Daemon

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.86 KB of source, external domains: nodejs.org

Source & flagged code

2 flagged

bin/vanexa-agent.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * VANEXA AGENT - Sovereign Digital Brain

4 * V8 Bytecode Launcher with Runtime Version Guard

5 */

6import path from 'path';

7import fs from 'fs';

8import { fileURLToPath } from 'url';

9import v8 from 'v8';

10import bytenode from 'bytenode';

11import { createRequire } from 'module';

12import { UI } from '../src/utils/cli_ui.js';

14const require = createRequire(import.meta.url);

15const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L13

16const __dirname = path.dirname(__filename);

18// ── V8 Version Guard ──

19// V8 bytecode is NOT portable across V8 engine versions.

20// The .jsc file MUST be loaded by the same V8 major version that compiled it.

21const REQUIRED_NODE_MAJOR = 24;

22const userNodeMajor = parseInt(process.versions.node.split('.')[0], 10);

24if (userNodeMajor < REQUIRED_NODE_MAJOR) {

25 UI.printFatalBox('FATAL: Node.js Version Mismatch', [

26 `Your Node.js: v${process.versions.node} (V8 ${process.versions.v8})`,

27 `Required: v${REQUIRED_NODE_MAJOR}.x LTS or higher`,

28 ``,

29 `Vanexa Agent uses V8 bytecode compiled for Node.js v24 LTS.`,

30 `The bytecode is incompatible with older Node.js versions.`,

31 ``,

32 `➤ Fix: Install Node.js v24 LTS from https://nodejs.org`,

33 ``,

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 4016616 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

Source & flagged code

2 flagged · loading source

bin/vanexa-agent.jsView file

13L14: const require = createRequire(import.meta.url); L15: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L13

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 4016616 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

Findings

1 High1 Medium4 Low

HighShips Node Bytecodedist/bundle.jsc

MediumDynamic Requirebin/vanexa-agent.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @vanexalabs-ai/vanexa-agent@1.8.1.

See all versions of @vanexalabs-ai/vanexa-agent for other recorded verdicts.

Review the evidence and your use of @vanexalabs-ai/vanexa-agent@1.8.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 07:41:20.910Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.