registry / Staged payload carrier / @vanexalabs-ai/vanexa-agent / 1.9.2

@vanexalabs-ai/vanexa-agent@1.9.2

Sovereign AI Agent Desktop Daemon

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is not proven to perform a concrete malicious action, but its opaque executable payload, dangerous capabilities, and reviewer manipulation prevent a clean verdict. The absence of install hooks keeps this below the publish-block threshold.

Static reason

No blocking static signals were detected.

Trigger

Import the package main entry point or run the vanexa CLI.

Impact

The bundle can perform actions beyond what the visible launcher can be audited to constrain.

Mechanism

Opaque bytecode execution with command and network capability.

AI rationale

Evidence

bin/vanexa-agent.jsdist/bundle.jscsocket.jsonsocket.yml

Network endpoints1

api.openai.com/v1/chat/completions

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Its Socket configuration suppresses findings for shell, filesystem, network, and obfuscated code.
The shipped configuration discusses malware detectors and a clean verdict, which is reviewer-directed manipulation.
The launcher immediately executes an opaque V8 bytecode bundle while source and the claimed CJS fallback are absent.
The opaque bundle contains shell-command functionality and hard-coded external API endpoints.

Evidence against

There is no npm preinstall, install, or postinstall hook.
The manifest has no dependency on this package itself.
The visible launcher’s bytecode rewrite path requires an unshipped bundle.cjs fallback.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 6.50 KB of source, external domains: nodejs.org

Source & flagged code

7 flagged

bin/vanexa-agent.jsView file

Lines 32-72javascript

33const UI = {

34 printFatalBox(title, lines) {

35 const inner = Math.max(50, lines.reduce((max, line) => Math.max(max, visibleLength(line)), visibleLength(title)) + 4);

36 const bar = '─'.repeat(inner);

37 const edge = (left, right) => console.log(` ${FATAL_COLOR}${left}${bar}${right}${FATAL_RESET}`);

38 const row = (text) => {

39 const pad = ' '.repeat(Math.max(0, inner - visibleLength(text) - 2));

40 console.log(` ${FATAL_COLOR}│${FATAL_RESET} ${text}${pad} ${FATAL_COLOR}│${FATAL_RESET}`);

41 };

43 console.log('');

44 edge('╭', '╮');

45 row(`${FATAL_COLOR}${FATAL_BOLD}${title}${FATAL_RESET}`);

46 edge('├', '┤');

47 for (const line of lines) row(line);

48 edge('╰', '╯');

49 console.log('');

50 }

51};

53const require = createRequire(import.meta.url);

54const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L52

55const __dirname = path.dirname(__filename);

57// ── V8 Version Guard ──

58// V8 bytecode is NOT portable across V8 engine versions.

59// The .jsc file MUST be loaded by the same V8 major version that compiled it.

60const REQUIRED_NODE_MAJOR = 24;

61const userNodeMajor = parseInt(process.versions.node.split('.')[0], 10);

63if (userNodeMajor < REQUIRED_NODE_MAJOR) {

64 UI.printFatalBox('FATAL: Node.js Version Mismatch', [

65 `Your Node.js: v${process.versions.node} (V8 ${process.versions.v8})`,

66 `Required: v${REQUIRED_NODE_MAJOR}.x LTS or higher`,

67 ``,

68 `Vanexa Agent uses V8 bytecode compiled for Node.js v24 LTS.`,

69 `The bytecode is incompatible with older Node.js versions.`,

70 ``,

71 `➤ Fix: Install Node.js v24 LTS from https://nodejs.org`,

72 ``,

Lines 108-148javascript

108 } catch (e) {

109 console.error('⚠ Auto-compile warning:', e.message);

110 return false;

111 }

112 }

113 return false;

114}

115

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 4675736 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jscView on unpkg

542Execute a shell command. CRITICAL CONSTRAINTS: 1. NEVER use interactive flags (like git rebase -i). 2. Always use non-interactive flags (--yes, -y). 3. If running git commit, always run git status, git diff, and git log first.

Medium

Ai Review Evidence

The opaque bundle contains shell-command functionality and hard-coded external API endpoints.

dist/bundle.jscView on unpkg · L542

5726https://api.openai.com/v1/chat/completions

Medium

Ai Review Evidence

The opaque bundle contains shell-command functionality and hard-coded external API endpoints.

dist/bundle.jscView on unpkg · L5726

socket.jsonView file

Lines 1-15json

2 "$schema": "https://socket.dev/config/v0.json",

3 "$comment": "Vanexa Agent declares only the capabilities it genuinely needs and suppresses nothing else. A previous wildcard packageRules block silenced every category for every transitive dependency; Amazon Inspector cited that file as evidence of concealment in MAL-2026-13397. Malware-intent detectors (aiMalware, gptMalware, usesEval, bypassesEnvironment, installScripts, typosquat) are deliberately LEFT ENABLED so their verdicts stay meaningful. Per-rule justifications are in socket.yml (shipped) and, in the public source repository, in SECURITY.md and docs/INFRASTRUCTURE.md, which enumera ...

4 "version": 2,

5 "project": "

socket.ymlView file

Lines 5-45yaml

6# Earlier releases carried a wildcard `packageRules` block that set every issue

7# category to `ignore` for every package by wildcard — every transitive dependency,

8# every rule.

9# Amazon Inspector cited exactly that in advisory MAL-2026-13397:

10#

11# "a socket.json file suppresses security scanning categories matching the

12# package's malicious behavior"

13#

14# A package that silences everything reads as concealment. A package that

Source & flagged code

7 flagged · loading source

bin/vanexa-agent.jsView file

52L53: const require = createRequire(import.meta.url); L54: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vanexa-agent.jsView on unpkg · L52

128function loadAgentBrain() { try { // Execute the protected proprietary brain require(bytecodePath); } catch (error) {

Medium

Ai Review Evidence

The launcher immediately executes an opaque V8 bytecode bundle while source and the claimed CJS fallback are absent.

bin/vanexa-agent.jsView on unpkg · L128

dist/bundle.jscView file

•path = dist/bundle.jsc kind = node_bytecode sizeBytes = 4675736 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/bundle.jsc

Findings

1 High7 Medium4 Low

HighShips Node Bytecodedist/bundle.jsc

MediumDynamic Requirebin/vanexa-agent.js

MediumEnvironment Vars

MediumAi Review Evidencesocket.json

MediumAi Review Evidencesocket.yml

MediumAi Review Evidencebin/vanexa-agent.js

MediumAi Review Evidencedist/bundle.jsc

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @vanexalabs-ai/vanexa-agent@1.9.2.

See all versions of @vanexalabs-ai/vanexa-agent for other recorded verdicts.

Review the evidence and your use of @vanexalabs-ai/vanexa-agent@1.9.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 02:42:20.996Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code