registry / Credential exfiltration / @xylex-group/athena / 5.4.1

@xylex-group/athena@5.4.1

Athena JS SDK

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

There is no install-time hook or proven secret-theft chain; scanner eval and remote-execute labels match Function-import helpers and base64 utilities. Residual risk remains because the 60k-line bundles cannot be fully traced and the SDK can send credentials to a hardcoded default gateway.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing the SDK or running the athena-js CLI, not npm install.

Impact

API keys and queries can go to the default Athena gateway; the CLI can update local env files and spawn git when those commands are used.

Mechanism

User-invoked SDK networking, dynamic import helpers, and CLI file or process operations

AI rationale

Evidence

package.jsondist/index.cjsdist/next/server.jsdist/cli/index.cjsbin/athena-js-dev.mjs.env.local

Network endpoints2

mirror2.athena-cluster.comauth.athena-auth.com

Decision evidence

public snapshot

AI called this Suspicious at 64.0% confidence as Dangerous Capability with high false-positive risk.

Evidence for warning

Main, Next, and CLI bundles are tens of thousands of lines, so this review and the scanner could not exhaustively prove every dynamic path is benign.
The SDK defaults a missing gateway URL to https://mirror2.athena-cluster.com and then fetch()es with headers that can carry API keys.
Bundled code uses Function() to dynamically import modules and to recover Node require for crypto.
The athena-js CLI can write a generated secret into project .env.local when the user passes --write.
A workspace-dev bin spawns Node with tsx, and the packed CLI spawnSyncs git.

Evidence against

package.json has no preinstall, install, or postinstall script; remaining hooks are prepack, postpack, and prepublishOnly.
Inspected Function() bodies are fixed import/require helpers, not eval of downloaded payloads.
Inspected atob use is base64url, cursor, and storage decoding rather than execute-after-fetch.
File writes inspected are generator, migration, and explicit CLI env updates, not hidden persistence.
Network names inspected are Athena product hosts plus OAuth and billing providers for this SDK.

Source & flagged code

10 flagged

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

dist/next/server.jsView file

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L662: const social = normalizeSocialFromRaw(raw); L663: const envForIdentity = options.env ?? process.env; L664: const appIdentity = options.identity !== void 0 ? options.identity : resolveAthenaAppIdentity({ ... L915: super({ L916: body: { missing: input.missing, operation: input.operation }, L917: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L1705: init_inspect(); L1706: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1707: } ... L8310:

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/next/server.jsView on unpkg · L1

16363async function loadNobleArgon2() { L16364: const importer = new Function( L16365: "specifier",

High

Eval

Package source references dynamic code evaluation.

dist/next/server.jsView on unpkg · L16363

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/next/server.jsView on unpkg · L1

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L1

bin/athena-js.jsView file

107const cliEntrypointUrl = pathToFileURL(cliEntrypointPath).href; L108: const cliModule = await import(cliEntrypointUrl); L109: if (typeof cliModule.runCLI !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/athena-js.jsView on unpkg · L107

dist/index.cjsView file

188Trigger-reachable chain: manifest.main -> dist/index.cjs L188: super({ L189: body: { missing: input.missing, operation: input.operation }, L190: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L497: // src/auth/bridge/code.ts L498: function toBase64Url(bytes) { L499: let binary = ""; ... L991: const social = normalizeSocialFromRaw(raw); L992: const envForIdentity = options.env ?? process.env; L993: const appIdentity = options.identity !== void 0 ? options.identity : resolveAthenaAppIdentity({ ... L1706: init_inspect(); L1707: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1708: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L188

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR; exports.AthenaBillingError = void 0; var ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERV... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends exports.AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError"; authorizationRights: "athena.authorization_rights",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

dist/cli/index.cjsView file

9Cross-file remote execution chain: dist/cli/index.cjs spawns dist/auth/server.cjs; helper contains network access plus dynamic code execution. L9: var pgsqlParser = require('pgsql-parser'); L10: var child_process = require('child_process'); L11: ... L87: L88: // package.json L89: var package_default; ... L364: type: "git", L365: url: "git+https://github.com/xylex-group/athena.git", L366: directory: "packages/athena-js" ... L1545: const isTty = options.isTty ?? Boolean( L1546: globalThis.process?.stdout?.isTTY L1547: );

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.cjsView on unpkg · L9

package.jsonView file

•dependencies registry_only=@xylex-group/athena

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Source & flagged code

10 flagged · loading source

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

dist/next/server.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/next/server.jsView on unpkg · L1

Findings

3 Critical7 High4 Medium5 Low

CriticalRemote Asset Decode Executedist/next/server.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

CriticalManifest Confusionpackage.json

HighChild Processbin/athena-js-dev.mjs

HighShell

HighEvaldist/next/server.js

HighCredential Redirect Persistencedist/index.cjs

HighCommand Output Exfiltrationdist/next/server.js

HighCloud Metadata Accessdist/next/server.js

HighCross File Remote Execution Contextdist/cli/index.cjs

MediumDynamic Requirebin/athena-js.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @xylex-group/athena@5.4.1.

See all versions of @xylex-group/athena for other recorded verdicts.

Review the evidence and your use of @xylex-group/athena@5.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 16:55:25.330Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

@xylex-group/athena@5.4.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code