registry / AI-agent capability abuse / @vanexalabs-ai/vanexa-agent / 1.9.19

@vanexalabs-ai/vanexa-agent@1.9.19

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No install-time attack is present, so blocking as confirmed malware is not justified. Opaque broad-capability code combined with scanner-directed suppression and embedded AI tool instructions is an unresolved, material risk.

Static reason

No blocking static signals were detected.

Trigger

A user runs or imports the vanexa CLI.

Impact

A user who runs the agent could expose local files or execute commands through behavior that is not auditable from the published source.

Mechanism

Opaque bytecode-backed AI agent with shell, filesystem, and network capabilities.

AI rationale

Evidence

socket.jsonbin/vanexa-agent.jsdist/bundle.jsc

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package disables scanner rules for shell, filesystem, network, and opaque/native-code access.
The launcher executes a five-megabyte opaque V8 bytecode bundle, leaving the application logic unavailable for normal source audit.
The bytecode embeds AI-directed instructions to invoke a dynamically constructed skill-reading tool.
The opaque bundle contains strings for host file writes, shell execution, API keys, and network clients.

Evidence against

There is no preinstall, install, or postinstall hook; the only lifecycle script is prepublishOnly.
The visible launcher runs the bundle only when the CLI is invoked and contains no credential harvesting or outbound request code.
There is no runtime dependency on this package itself.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 7.37 KB of source, external domains: nodejs.org

Source & flagged code

4 flagged

bin/vanexa-agent.jsView file

Lines 32-72javascript

33const UI = {

34 printFatalBox(title, lines) {

35 const inner = Math.max(50, lines.reduce((max, line) => Math.max(max, visibleLength(line)), visibleLength(title)) + 4);

36 const bar = '─'.repeat(inner);

37 const edge = (left, right) => console.log(` ${FATAL_COLOR}${left}${bar}${right}${FATAL_RESET}`);

38 const row = (text) => {

39 const pad = ' '.repeat(Math.max(0, inner - visibleLength(text) - 2));

40 console.log(` ${FATAL_COLOR}│${FATAL_RESET} ${text}${pad} ${FATAL_COLOR}│${FATAL_RESET}`);

41 };

43 console.log('');

44 edge('╭', '╮');

45 row(`${FATAL_COLOR}${FATAL_BOLD}${title}${FATAL_RESET}`);

46 edge('├', '┤');

47 for (const line of lines) row(line);

48 edge('╰', '╯');

49 console.log('');

50 }

51};

53const require = createRequire(import.meta.url);

54const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L52

55const __dirname = path.dirname(__filename);

57// ── V8 Version Guard ──

58// V8 bytecode is NOT portable across V8 engine versions.

59// The .jsc file MUST be loaded by the same V8 major version that compiled it.

60const REQUIRED_NODE_MAJOR = 24;

61const userNodeMajor = parseInt(process.versions.node.split('.')[0], 10);

63if (userNodeMajor < REQUIRED_NODE_MAJOR) {

64 UI.printFatalBox('FATAL: Node.js Version Mismatch', [

65 `Your Node.js: v${process.versions.node} (V8 ${process.versions.v8})`,

66 `Required: v${REQUIRED_NODE_MAJOR}.x LTS or higher`,

67 ``,

68 `Vanexa Agent uses V8 bytecode compiled for Node.js v24 LTS.`,

69 `The bytecode is incompatible with older Node.js versions.`,

70 ``,

71 `➤ Fix: Install Node.js v24 LTS from https://nodejs.org`,

72 ``,

Lines 127-167javascript

127

128/**

129 * Hand the terminal back before printing a crash box. UX-02.

130 *

131 * The AGENT CRASH branch below catches a throw from INSIDE the running bundle,

132 * which can happen long after the Stage armed mouse reporting and reserved a

133 * band. Printing a box into a terminal that is still reporting every click, with

134 * the cursor hidden, is how a crash turns into a terminal the user thinks is

135 * broken and cannot fix.

136 *

137 * Written out as literal bytes because this file MUST NOT import from src/ —

138 * see the note on the fatal box above. They are the exact counterparts of

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 5002208 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

socket.jsonView file

Lines 1-15json

2 "$schema": "https://socket.dev/config/v0.json",

3 "$comment": "Vanexa Agent declares only the capabilities it genuinely needs and suppresses nothing else. A previous wildcard packageRules block silenced every category for every transitive dependency; Amazon Inspector cited that file as evidence of concealment in MAL-2026-13397. Malware-intent detectors (aiMalware, gptMalware, usesEval, bypassesEnvironment, installScripts, typosquat) are deliberately LEFT ENABLED so their verdicts stay meaningful. Per-rule justifications are in socket.yml (shipped) and, in the public source repository, in SECURITY.md and docs/INFRASTRUCTURE.md, which enumera ...

4 "version": 2,

5 "project": "

Source & flagged code

4 flagged · loading source

bin/vanexa-agent.jsView file

52L53: const require = createRequire(import.meta.url); L54: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L52

147function loadAgentBrain() { try { // Execute the protected proprietary brain require(bytecodePath); } catch (error) {

Medium

Ai Review Evidence

The launcher executes a five-megabyte opaque V8 bytecode bundle, leaving the application logic unavailable for normal source audit.

bin/vanexa-agent.jsView on unpkg · L147

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 5002208 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jsc

Findings

1 High4 Medium4 Low

HighShips Node Bytecodedist/bundle.jsc

MediumDynamic Requirebin/vanexa-agent.js

MediumEnvironment Vars

MediumAi Review Evidencesocket.json

MediumAi Review Evidencebin/vanexa-agent.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @vanexalabs-ai/vanexa-agent@1.9.19.

See all versions of @vanexalabs-ai/vanexa-agent for other recorded verdicts.

Review the evidence and your use of @vanexalabs-ai/vanexa-agent@1.9.19 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 21:14:56.491Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code