aethel-autapon@1.0.5
Compilador DAG para coordinación de agentes autónomos en Monad
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package's main module automatically uses local agent credentials to send repeated payments to a fixed address without an explicit user request. This is concrete unauthorized spending behavior, so the package is malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
Import or execution of the package main, dag-compiler.mjs.
Impact
Uses configured agent wallets and passkeys to make unrequested on-chain payments and writes dashboard status to a fixed path.
Mechanism
Loads agent keys from mandatos-agentes.json, creates three 0.05 payment intents per agent to a fixed recipient, and runs the validation and payment pipeline at top level.
Attack narrative
The package main executes immediately when imported or run. It loads agent private keys from mandatos-agentes.json, creates three 0.05 payment intents for every agent to the hard-coded address 0xF6805F61820A860db4B7462Bc9940793fC8ed22A, and runs the payment pipeline using the agents' passkeys. This spends wallet funds without a per-payment user request or configurable recipient.
AI rationale
The package's main module automatically uses local agent credentials to send repeated payments to a fixed address without an explicit user request. This is concrete unauthorized spending behavior, so the package is malicious.
Evidence
package.jsondag-compiler.mjsmandatos-agentes.json/home/usuariochan/agent-yarbox/explorer/web/dashboard-status.json
Network endpoints1
rpc.monad.xyz
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package main is dag-compiler.mjs, which executes its workflow at module top level.
- The entry reads mandatos-agentes.json and loads each agent's privateKey.
- It creates three 0.05 payment intents per agent for the same hard-coded recipient.
- The top-level workflow validates and executes those intents without an explicit user request; the payment call uses each agent's passkey and key-backed SDK.
- Execution also attempts to write dashboard status to a fixed absolute path.
Evidence against
- The manifest has no install lifecycle scripts.
- The configured RPC endpoint supports the package's stated Monad payment coordination purpose.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
5 flaggedpackage.jsonView file
2"name": "aethel-autapon",
"version": "1.0.5",
"description": "Compilador DAG para coordinación de agentes autónomos en Monad",
"main": "dag-compiler.mjs",
"type": "modu
High
Ai Review Evidence
The package main is dag-compiler.mjs, which executes its workflow at module top level.
package.jsonView on unpkg · L2dag-compiler.mjsView file
69const mandatos = JSON.parse(readFileSync("mandatos-agentes.json", "utf8"));
const agentes = mandatos.map(m => ({
agentId: m.agentId,
address: m.address,
mandateId: m.mandateId,
privateKey: m.privateKey,
passkey
High
Ai Review Evidence
The entry reads mandatos-agentes.json and loads each agent's privateKey.
dag-compiler.mjsView on unpkg · L69223console.log("=== COMPILADOR DAG AETHEL-AUTAPON ===");
const intenciones = [];
for (const agente of agentes) for (let i = 0; i < 3; i++) intenciones.push({ agente, amount: "0.05", recipient: "[redacted]" });
const { validas } = await validarIntenciones(intenciones);
if (validas.length ==
Findings
5 High3 Medium3 Low
HighAi Review Evidencepackage.json
HighAi Review Evidencedag-compiler.mjs
HighAi Review Evidencedag-compiler.mjs
HighAi Review Evidencedag-compiler.mjs
HighAi Review Evidencedag-compiler.mjs
MediumNetwork
MediumEnvironment Vars
MediumGit Dependency
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aethel-autapon@1.0.5.
See all versions of aethel-autapon for other recorded verdicts.
- Avoid installing aethel-autapon@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.