registry / agent-bot-api / 1.0.1

agent-bot-api@1.0.1

AI Security Review

scanned 15d ago · by lpm-firewall-ai

When started, the package enrolls the machine with a hardcoded remote panel and continuously retrieves commands. Panel-controlled commands can execute shell commands and manipulate files under the process working directory.

Static reason

No blocking static signals were detected.

Trigger

Explicit runtime call to Agent.start()

Impact

Remote operator can execute commands, read project files, and modify or delete files; host/network metadata is exfiltrated during registration.

Mechanism

hardcoded remote command-and-control agent with shell execution

Attack narrative

After an application explicitly starts the exported Agent, it registers machine and network details with the hardcoded panel, saves a returned token, then polls the panel every five seconds. Commands supplied by that panel can invoke child_process.exec and perform read, write, rename, and delete operations, with authorization flags fetched from the same panel.

Rationale

The package implements a remotely controlled execution and file-management agent against an unrelated hardcoded endpoint. Although it has no install hook and requires runtime activation, the resulting command-and-control capability is concrete.

Evidence

config.jsindex.jslib/client.jslib/executor.jslib/permissions.jspackage.json.cache/publickey.txt

Network endpoints5

server.junofficial.biz.id/api/registerserver.junofficial.biz.id/api/heartbeat

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12138

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in agent-bot-api (npm)

Details

Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the installer's hostname to /api/register, heartbeats /api/heartbeat every 15 seconds, and polls /api/command/{token} every 5 seconds. Commands returned by the server are passed to child_process.exec with a configurable working directory, and additional operations perform arbitrary fs.readFile / fs.writeFile / rename / remove on the host filesystem. Command output is POSTed back to the same server. A server-issued token is persisted to.cache/publickey.txt, giving the operator persistent keyed reachability to the installer host. This is a full remote shell / RAT with attacker-controlled RCE on any machine that installs or runs the package.

References

OSV advisory OpenSSF JSON PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

lib/executor.js polls a remote command every 5 seconds.
lib/executor.js executes server-supplied commands with child_process.exec.
lib/executor.js permits remote read, write, rename, and deletion actions.
lib/client.js registers host, IP/MAC, disk, kernel, and system data to a hardcoded panel.
config.js hardcodes server.junofficial.biz.id.

Evidence against

package.json has no lifecycle scripts.
Runtime activation requires calling Agent.start(); import alone does not start it.
The declared bin path is absent, so its CLI is not install-runnable as packaged.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 7 file(s), 17.0 KB of source, external domains: server.junofficial.biz.id

Source & flagged code

4 flagged

lib/executor.jsView file

•Published source reference

High

Ai Review Evidence

lib/executor.js polls a remote command every 5 seconds.

lib/executor.jsView on unpkg

•Published source reference

High

Ai Review Evidence

lib/executor.js executes server-supplied commands with child_process.exec.

lib/executor.jsView on unpkg

•Published source reference

High

Ai Review Evidence

lib/executor.js permits remote read, write, rename, and deletion actions.

lib/executor.jsView on unpkg

lib/client.jsView file

•Published source reference

High

Source & flagged code

4 flagged · loading source

lib/executor.jsView file

•Published source reference

High

Ai Review Evidence

lib/executor.js polls a remote command every 5 seconds.

lib/executor.jsView on unpkg

•Published source reference

High

Ai Review Evidence

lib/executor.js executes server-supplied commands with child_process.exec.

lib/executor.jsView on unpkg

•Published source reference

High

Ai Review Evidence

lib/executor.js permits remote read, write, rename, and deletion actions.

lib/executor.jsView on unpkg

lib/client.jsView file

•Published source reference

Findings

5 High2 Medium3 Low

HighAi Review Evidencelib/executor.js

HighAi Review Evidencelib/client.js

HighAi Review Evidence

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowUrl Strings

LowNo License