aethel-autapon@1.0.3
Compilador DAG para coordinación de agentes autónomos en Monad
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe declared main entry executes payment code at top level, using loaded wallet credentials to send repeated payments to a hard-coded recipient. Because importing the package can trigger those payments and the dry-run flag does not stop them, this is malicious automatic spending.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the declared main entry point, or running the documented command, executes the top-level payment workflow.
Impact
Agent funds may be spent automatically and sent to a publisher-selected recipient.
Mechanism
It loads wallet keys and passkeys from mandatos-agentes.json, creates three 0.05 MON payments per agent to 0xF6805F61820A860db4B7462Bc9940793fC8ed22A, and submits them through the Mandate SDK. The --dry-run flag does not prevent this.
Attack narrative
Importing the package’s declared main entry runs its payment workflow at top level. The script loads agent private keys and passkeys from mandatos-agentes.json, then creates and submits three 0.05 MON payments per agent to a hard-coded recipient. The --dry-run flag is parsed but does not stop the transactions, so importing the package can spend funds without an explicit payment request.
AI rationale
The declared main entry executes payment code at top level, using loaded wallet credentials to send repeated payments to a hard-coded recipient. Because importing the package can trigger those payments and the dry-run flag does not stop them, this is malicious automatic spending.
Evidence
package.jsondag-compiler.mjsmandatos-agentes.json
Network endpoints1
rpc.monad.xyz
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package manifest sets dag-compiler.mjs as its main entry point, which executes top-level code when imported.
- The entry point reads private keys and passkeys from mandatos-agentes.json.
- Top-level code creates three 0.05 MON payment intentions per agent to the same hard-coded recipient.
- The payment routine signs contract transactions with the loaded private keys and calls the SDK pay method with each intention’s amount and recipient.
- The --dry-run flag is read but does not gate the payment flow.
Evidence against
- The manifest defines no install lifecycle scripts.
- The README describes running the compiler with node dag-compiler.mjs as its intended use.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
6 flaggedpackage.jsonView file
2"name": "aethel-autapon",
"version": "1.0.3",
"description": "Compilador DAG para coordinación de agentes autónomos en Monad",
"main": "dag-
High
Ai Review Evidence
The package manifest sets dag-compiler.mjs as its main entry point, which executes top-level code when imported.
package.jsonView on unpkg · L2dag-compiler.mjsView file
57const mandatos = JSON.parse(readFileSync("mandatos-agentes.json", "utf8"));
const agentes = mandatos.map(m => ({
agentId: m.agentId,
address: m.address,
mandateId: m.mandateId,
privateKey: m.privateKey,
passkey: {
privateKey: new Uint8Array(m.passkey.privateKey),
pu
High
Ai Review Evidence
The entry point reads private keys and passkeys from mandatos-agentes.json.
dag-compiler.mjsView on unpkg · L57366const PAGOS_POR_AGENTE = 3;
const RECIPIENT = "[redacted]";
const intenciones = [];
for (const agente of agentes) {
for (let i = 0; i < PAGOS_POR_AGENTE; i
Findings
6 High3 Medium3 Low
HighAi Review Evidencepackage.json
HighAi Review Evidencedag-compiler.mjs
HighAi Review Evidencedag-compiler.mjs
HighAi Review Evidencedag-compiler.mjs
HighAi Review Evidencedag-compiler.mjs
HighAi Review Evidencedag-compiler.mjs
MediumNetwork
MediumEnvironment Vars
MediumGit Dependency
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aethel-autapon@1.0.3.
See all versions of aethel-autapon for other recorded verdicts.
- Avoid installing aethel-autapon@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.