aclade-agent
Aclade Local AI Agent Connector
This report shows the evidence for aclade-agent@1.0.6. 5 of 10 known versions are blocked or flagged. The newest version, 1.3.0, is flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13614 confirms this npm version as malicious.
Advisory
MAL-2026-13614
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in aclade-agent (npm)
Details
The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported operations include execute_bash (child_process.spawn with shell:true on a server-supplied command string), read_file/write_file/replace_file_content against arbitrary filesystem paths, recursive directory listing, grep_search, and schedule_cron (cron.schedule wrapping child_process.exec on a server-supplied command, providing persistence across reboots). All task fields come from the network peer, giving aclade.com full remote code execution, filesystem read/write, and scheduled-task persistence on any host running the agent. The daemon additionally polls https://registry.npmjs.org/aclade-agent/latest hourly and, on version change, runs `npm install -g aclade-agent@latest` and re-execs itself, so any future publication of the package (including from a compromised maintainer account) is automatically fetched and executed at the daemon's privilege level (README documents global install via sudo/PM2).
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
This is a real, high-impact remote administration capability, but source inspection shows it is activated by an explicit CLI invocation and has no install-time execution. The code supports the declared connector purpose, so malicious intent is not established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs aclade-agent connect with a token, then the daemon polls for tasks.
Impact
Configured server can execute commands, read or modify accessible files, schedule commands, and receive results.
Mechanism
remote task-driven shell and filesystem control
AI rationale
This is a real, high-impact remote administration capability, but source inspection shows it is activated by an explicit CLI invocation and has no install-time execution. The code supports the declared connector purpose, so malicious intent is not established.
Evidence
package.jsonsrc/index.tsdist/index.js~/.aclade-agent.json~/.aclade-agent.log
Network endpoints3
aclade.com/api/connector/pollaclade.com/api/connector/respondregistry.npmjs.org/aclade-agent/latest
Independent scan evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- dist/index.js polls a remote task endpoint and executes execute_bash with shell:true.
- dist/index.js supports remote arbitrary file read, write, replacement, recursive listing, grep, and cron command scheduling.
- Task results, including command output and file contents, are POSTed back to the configured host.
- The default runtime starts a detached background daemon and auto-installs the latest package version.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Execution requires an explicit CLI launch plus a supplied or previously saved token.
- Source and compiled entrypoint agree; no hidden alternate payload was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/index.jsView file
38const https = __importStar(require("https"));
L39: const child_process = __importStar(require("child_process"));
L40: const fs = __importStar(require("fs"));
High
125const proc = child_process.spawn(input.command, [], {
L126: shell: true,
L127: stdio: ['ignore', 'pipe', 'pipe']
High
277try {
L278: child_process.execSync("npm install -g aclade-agent@latest", { stdio: "ignore" });
L279: console.log(`=> [UPDATE] Upgrade complete. Restarting agent...`);
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L277src/index.tsView file
Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/index.ts
HighChild Processdist/index.js
HighShelldist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to aclade-agent@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing aclade-agent@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.