registry / Remote code execution / agentgui

agentgui

Multi-agent ACP client with real-time communication

This report shows the evidence for agentgui@1.0.1127. 1 of 47 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The runtime-reachable, obfuscated blockchain-resolved loader executes attacker-supplied code and spawns a detached process. The benign postinstall hook does not mitigate this independent malicious chain.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User starts the CLI, Electron app, or server.js.

Impact

Arbitrary attacker-controlled code execution and persistent background process creation under the invoking user.

Mechanism

blockchain-addressed encrypted payload retrieval followed by eval and detached process execution

Attack narrative

On normal startup, server.js imports database.js. After its legitimate database export, database.js contains an obfuscated immediately invoked loader that queries Ethereum services, reconstructs C2 host addresses from transaction bytes, retrieves XOR-encrypted code, evaluates one payload, and runs another via detached hidden node -e. This is a concrete remote code-execution chain, not package-aligned functionality.

AI rationale

Evidence

database.jsserver.jspackage.json

Network endpoints6

1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.ioeth.blockscout.com/apidynamic blockchain-derived HTTP hosts (/0x/cls, /0x/ls)

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

database.js:109 appends an obfuscated top-level async payload to normal database code.
The payload queries Ethereum RPC/block-explorer services to derive command hosts from transaction data.
It XOR-decrypts remote HTTP responses and executes one with eval().
It starts a detached, hidden node -e process for a second remote payload.
server.js:9 imports database.js during normal server startup, making the payload runtime-reachable.

Evidence against

package.json postinstall only patches fsbrowse and rebuilds better-sqlite3; it does not invoke the payload.
electron/main.js and bin/gmgui.cjs otherwise implement expected local GUI/server startup.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/patch-fsbrowse.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/patch-fsbrowse.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

database.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agentgui@1.0.1126 matchedIdentity = npm:YWdlbnRndWk:1.0.1126 similarity = 0.827 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

database.jsView on unpkg

108L109: export default { queries }; ... L110:

High

Child Process

Package source references child process execution.

database.jsView on unpkg · L108

108L109: export default { queries }; ... L110:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

database.jsView on unpkg · L108

38L39: const require = createRequire(import.meta.url); L40:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

database.jsView on unpkg · L38

108L109: export default { queries }; ... L110:

Low

Eval

Package source references a known benign dynamic code generation pattern.

database.jsView on unpkg · L108

lib/terminal.jsView file

23function defaultShell() { L24: if (os.platform() === 'win32') return process.env.COMSPEC || 'cmd.exe'; L25: return process.env.SHELL || '/bin/bash';

High

Shell

Package source references shell execution.

lib/terminal.jsView on unpkg · L23

test-integration.jsView file

22import crypto from 'crypto'; L23: import http from 'http'; L24: import { WebSocket } from 'ws'; ... L242: // Paths starting with ~ should expand to homedir before confinement. L243: const home = os.homedir(); L244: const file = path.join(home, '.bashrc'); L245: if (fs.existsSync(file)) { ... L276: try { L277: const _decoded = Buffer.from(_auth.slice(6), 'base64').toString('utf8'); L278: const _ci = _decoded.indexOf(':'); ... L286: } L287: if (!_ok) { res.writeHead(401); res.end('Unauthorized'); return; }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

test-integration.jsView on unpkg · L22

electron/main.jsView file

10const BASE_URL = (process.env.BASE_URL || '/gm').replace(/\/+$/, ''); L11: const APP_URL = `http://localhost:${PORT}${BASE_URL}/`; L12: ... L19: // Electron/Chromium app runtime just to host the background HTTP server. L20: serverProcess = spawn(process.execPath, ['server.js'], { L21: cwd: ROOT, ... L24: }); L25: serverProcess.stdout.on('data', d => process.stdout.write(`[server] ${d}`)); L26: serverProcess.stderr.on('data', d => process.stderr.write(`[server] ${d}`));

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

electron/main.jsView on unpkg · L10

10Trigger-reachable command-output exfiltration chain: manifest.main -> electron/main.js L10: const BASE_URL = (process.env.BASE_URL || '/gm').replace(/\/+$/, ''); L11: const APP_URL = `http://localhost:${PORT}${BASE_URL}/`; L12: ... L19: // Electron/Chromium app runtime just to host the background HTTP server. L20: serverProcess = spawn(process.execPath, ['server.js'], { L21: cwd: ROOT, ... L24: }); L25: serverProcess.stdout.on('data', d => process.stdout.write(`[server] ${d}`)); L26: serverProcess.stderr.on('data', d => process.stderr.write(`[server] ${d}`));

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

electron/main.jsView on unpkg · L10

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-fsbrowse.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/patch-fsbrowse.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

database.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Findings

1 Critical6 High8 Medium7 Low

CriticalPrevious Version Dangerous Deltadatabase.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdatabase.js

HighShelllib/terminal.js

HighSame File Env Network Executiondatabase.js

HighCommand Output Exfiltrationelectron/main.js

HighTrigger Reachable Command Output Exfiltrationelectron/main.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredatabase.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencetest-integration.js

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to agentgui@1.0.1127.

The versions list below shows the verdict for each recorded version.

Avoid installing agentgui@1.0.1127. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 08:45:11.762Z (UTC).

Source advisory published: 2026-08-24 07:52:43.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

47 known versions

1.0.1127latestshownMaliciousRemote Code ExecutionBlockPublishedAug 9, 2026, 11:03 PM 1.0.1126SuspiciousAgent extension lifecycle riskWarnPublishedAug 9, 2026, 2:03 PM 1.0.1124SuspiciousAgent extension lifecycle riskWarnPublishedAug 9, 2026, 1:53 PM 1.0.1123SuspiciousAgent extension lifecycle riskWarnPublishedAug 9, 2026, 1:38 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages