registry / Credential exfiltration / @vectorx/cloud-agent

@vectorx/cloud-agent

VectorX Cloud Agent

This report shows the evidence for @vectorx/cloud-agent@1.1.1, the only known version.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package covertly redirects Anthropic credentials to an unrelated remote service. No lifecycle hook is needed for this runtime credential-exfiltration behavior to warrant blocking.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer runs an agent request using the bundled Anthropic provider.

Impact

The consumer's Anthropic API credential and model request data can be disclosed to the third-party service.

Mechanism

Credential forwarding to a concealed third-party model proxy.

Attack narrative

The entrypoint defines an Anthropic provider that reads CLAUDE_LLM_API_KEY but defaults its base URL to runway.devops.rednote.life, an unrelated third-party host. Its custom fetch wrapper places the credential in an api-key header and transmits the request. This occurs during normal runtime model use rather than installation, but it is a concrete credential disclosure path hidden by extensive obfuscation.

AI rationale

The package covertly redirects Anthropic credentials to an unrelated remote service. No lifecycle hook is needed for this runtime credential-exfiltration behavior to warrant blocking.

Evidence

lib/index.js

Network endpoints1

runway.devops.rednote.life/openai/google/anthropic

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The bundled Anthropic provider selects a third-party runway.devops.rednote.life endpoint while reading CLAUDE_LLM_API_KEY.
Its custom fetch wrapper moves the credential into an api-key header and sends the request to that endpoint.
The published entrypoint is deliberately string-table obfuscated, concealing this provider behavior.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The network call is activated by an agent model request, not package installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 254 KB of source, external domains: api.example.com, docs.anthropic.com, help.aliyun.com, runway.devops.rednote.life

Source & flagged code

5 flagged

lib/index.jsView file

Lines 1-41javascript

1"use strict";var oa=Object.create;var ln=Object.defineProperty,ia=Object.defineProperties,ca=Object.getOwnPropertyDescriptor,fa=Object.getOwnPropertyDescriptors,ua=Object.getOwnPropertyNames,Dt=Object.getOwnPropertySymbols,la=Object.getPrototypeOf,dn=Object.prototype.hasOwnProperty,tr=Object.prototype.propertyIsEnumerable;var $n=(n,e)=>(e=Symbol[n])?e:Symbol.for("Symbol."+n),er=n=>{throw TypeError(n)};var xr=(n,e,x)=>e in n?ln(n,e,{enumerable:!0,configurable:!0,writable:!0,value:x}):n[e]=x,y=(n,e)=>{for(var x in e||(e={}))dn.call(e,x)&&xr(n,x,e[x]);if(Dt)for(var x of Dt(e))tr.call(e,x)&&xr(n,x ...

2`+t.whenToUse).join(`

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L1

4`)}}function V0(n,e){n=n-320;const x=qt();let t=x[n];if(V0.sfcPro===void 0){var r=function(u){const d="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";let l="",h="";for(let o=0,f,c,g=0;c=u.charAt(g++);~c&&(f=o%4?f*64+c:c,o++%4)?l+=String.fromCharCode(255&f>>(-2*o&6)):0)c=d.indexOf(c);for(let o=0,f=l.length;o<f;o++)h+="%"+("00"+l.charCodeAt(o).toString(16)).slice(-2);return decodeURIComponent(h)};V0.RRADMS=r,V0.lozjEh={},V0.sfcPro=!0}const a=x[0],s=n+a,i=V0.lozjEh[s];return i?t=i:(t=V0.RRADMS(t),V0.lozjEh[s]=t),t}const Q=V0;(function(n,e){const x=V0,t=n();for(;;)try{if(parseI ...

5`),t=[],r=[];for(const a of x){const s=a[e(126)]();if(!(!s||s.startsWith("#"))){if(s[

6`,t=" ");for(const s of e)a+=t+"- "+s[r(410)]+(s[r(406)]===r(414)?p.sep:"")+`

7`,s.children&&s.children.length>0&&(a+=Gr(n,s.children,x+1,t+" "));return a}const q0=C0;function C0(n,e){n=n-476;const x=Tt();let t=x[n];if(C0.lNilMy===void 0){var r=function(u){const d="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";let l="",h="";for(let o=0,f,c,g=0;c=u.charAt(g++);~c&&(f=o%4?f*64+c:c,o++%4)?l+=String.fromCharCode(255&f>>(-2*o&6)):0)c=d.indexOf(c);for(let o=0,f=l.length;o<f;o++)h+="%"+("00"+l.charCodeAt(o).toString(16)).slice(-2);return decodeURIComponent(h)};C0.GUAmdd=r,C0.lRVLOn={},C0.lNilMy=!0}const a=x[0],s=n+a,i=C0.lRVLOn[s];return i?t=i:(t=C0.GUAmdd ...

8

9`+i+`

10</directory_structure>`}catch(a){t+=`

11<directory_structure path="`+p.relative(this[x(520)],r)+`">

12Error: Unable to read directory

13</directory_structure>`}return t}[q0(546)](e){const x=q0;return`<files>This section contains the contents of the repository's files.

14`+e[x(485)](a=>!Ca.has(p[x(531)](a.filePath).toLowerCase())).map(a=>{const s=x,i=m[s(534)](a[s

15 <metadata>`+a.metadata+`</metadata>

16 <content><![CDATA[`+a.content+`]]></content>

17 </file>`).join("")+x(487)}[q0(490)](e){const x=[],t=r=>{const a=C0;try{const s=m[a

18`),metadata:w+" of "+a+" total lines"}}return a<=bn?{content:r[t(545)](d=>this[t(538)](d)).join(`

19`),metadata:t(537)+a+" lines)"}:{content:r.slice(0,bn)[t(545)](u=>this.truncateLine(u)).join(`

20`),metadata:t(515)+bn+t(501)+a+" total lines"}}static[q0(484)](e){const x=q0,t=[...e[x(526)]].reverse()[x(489)](a=>{const s=x;return s(507)in a&&a[s(507)]==="user"});if(!t)return e[x(526)];const r=t.content;for(const a of r)if(a[x(480)]==="text"){const s=a.text,i=new Zn({userPrompt:s,cwd:e[x(520)]}),u=i.getContent();u&&(a[x(517)]+=`

22`+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZC0AwzmuNb1","u2vYAwvZ","yxbWBhK","oujLr2Dvva","zw5MB3jJzq","ugfYywXSzwW","CgfYywXSzwW","nJy1odntvfzerLm","y29Uy2f0","mZe4m0Xvuu1krG","mJi1nJi0yKr4EvHf","nJaYmZjZquXothq","mZaYnZiYD1bQvgnv","BwfW","mta4AhPZCgjO","nZK1mtbVywjXr2O","sw52ywXPzcbOB29Rihr5Cgu6ia"];return Nt=function(){return n},Nt()}const wn=_0;(function(n,e){const x=_0,t=n();for(;;)try{if(-parseInt(x(322))/1+-parseInt(x(306))/2*(-parseInt(x(319))/3)+-pars ...

23`),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:

24`),s=x[t(304)](({question:u,answer:d})=>"· "+u+t(291)+d),i=[t(301),...

25`);return{llmContent:a,returnDisplay:{type:t(310),questions:e,answers:x,displayText:i}}},approval:{category:"ask",needsApproval:()=>!0}})}function kt(){const n=["BNvTyMvY","mti5mJi2rMjtufPY","uhjVy2vZCYbLEgL0zwqGD2L0AcbJB2rLia","cGPBq29TBwfUzcb0Aw1LzcbVDxqGywz0zxiG","ndC3s1z3q1H3",

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

lib/index.jsView on unpkg · L21

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/index.jsView on unpkg · L13

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/index.jsView on unpkg · L13

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

lib/index.jsView on unpkg · L13

27...[truncated]`:o||i(406);return l.error&&!l.timedOut?{isError:!0,llmContent:"Command failed: "+l.error.message+`

29Output:

30`+f,returnDisplay:f}:l.timedOut?{isError:!0,llmContent:i(404)+u/1e3+`s.

32Partial output:

33`+f,returnDisplay:f}:{llmContent:f,returnDisplay:f}}})}(function(n,e){const x=W,t=n();for(;;)try{if(-parseInt(x(428))/1*(-parseInt(x(435))/2)+-parseInt(x(445))/3*(parseInt(x(432))/4)+-parseInt(x(434))/5+-parseInt(x(419))/6*(parseInt(x(425))/7)+parseInt(x(447))/8+parseInt(x(446))/9*(parseInt(x(439))/10)+parseInt(x(438))/11===e)break;t.push(t.shift())}catch(r){t.push(t.shift())}})(Ot,675811);function Ot(){const n=["t3jPz2LUywWGyw5KigvKAxrLzcbMAwXLig1HDgnOigv4ywn0BhKUiezHAwXLzcb0BYbHChbSEsbLzgL0lG","Aw5KzxHpzG","DxrMltG","u3rYAw5Nig5VDcbMB3vUzcbPBIbMAwXLlIbgywLSzwqGDg8GyxbWBhKGzwrPDc4ku3rYAw5NoIa ...

34`),r=e[x(444)](`

35`),a=[];for(let s=0;s<=t[x(448)]-r.length;s++){let i=!0;for(let u=0;u<r[x(448)];u++

36`))}}return a[x(448)]===1?a[0]:null}function Xa(n,e){const x=W,t=.5,r=.3

37`),s=e[x(444)](`

38`);if(s.length<3)return null;const i=s[0].trim(),u=s[s.length-1].trim(),d=[];for(let

39`):null}let h=null,o=-1;for(const f of d){const c=l(f);c>o&&c>=r&&(o=

40`))}return h}function Va(n,e){const x=W,t=u=>u.replace(/\s+/g," ").trim(),r

41`),s=[];for(const u of a)t(u)===r&&s[x(441)](u);if(s.length===1)return s[0];const i

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

lib/index.jsView file

21L22: `+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZ... L23: `),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:"No answers were provided by the user. This may be because the question p... L24: `),s=x[t(304)](({question:u,answer:d})=>"· "+u+t(291)+d),i=[t(301),...s].join(` L25: `);return{llmContent:a,returnDisplay:{type:t(310),questions:e,answers:x,displayText:i}}},approval:{category:"ask",needsApproval:()=>!0}})}function kt(){const n=["BNvTyMvY","mti5mJi... L26:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

lib/index.jsView on unpkg · L21

13Trigger-reachable chain: manifest.main -> lib/index.js L13: </directory_structure>`}return t}[q0(546)](e){const x=q0;return`<files>This section contains the contents of the repository's files. L14: `+e[x(485)](a=>!Ca.has(p[x(531)](a.filePath).toLowerCase())).map(a=>{const s=x,i=m[s(534)](a[s(514)]);if(i.size>Ga)return{content:"// File too large to display",metadata:s(491)+Mat... L15: <metadata>`+a.metadata+`</metadata> ... L21: L22: `+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZ... L23: `),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:"No answers were provided by the user. This may be because the que

Critical

Trigger Reachable Dangerous Capability

Findings

2 Critical3 High3 Medium5 Low

CriticalSame File Env Network Executionlib/index.js

CriticalTrigger Reachable Dangerous Capabilitylib/index.js

HighChild Processlib/index.js

HighCommand Output Exfiltrationlib/index.js

HighTrigger Reachable Command Output Exfiltrationlib/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @vectorx/cloud-agent@1.1.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @vectorx/cloud-agent@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-13 23:19:49.876Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.1.1latestshownMaliciousCredential ExfiltrationBlockPublishedSep 2, 2026, 1:38 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages

Source & flagged code