registry / Remote code execution / janex-agent

janex-agent

Autonomous Multi-Agent AI Workspace in your terminal. Codes, researches, and executes real tasks with 40+ tools and 280+ skills

This report shows the evidence for janex-agent@1.0.39. 2 of 4 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The install hook contains a concrete unconsented remote-code-execution chain, not merely a dormant capability. Its apparent runtime-bootstrap purpose does not mitigate execution of mutable remote content at install time.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install / postinstall

Impact

Arbitrary code execution and user-home/runtime mutation under the installing user.

Mechanism

Remote shell-pipeline execution

Attack narrative

The manifest invokes scripts/postinstall.mjs on every install. On systems without Bun, it runs a downloaded shell script directly through bash with no version pin, checksum, or user confirmation. A compromised or changed remote installer therefore executes arbitrary code during npm installation; the launcher repeats this behavior when run.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsbin/janex.jsdist/tools/McpManage.jsdist/mcp/McpRegistry.jsnode_modules/@opentui/react/chunk-fm0c65gm.js~/.bun

Network endpoints1

bun.sh/install

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs postinstall automatically.
scripts/postinstall.mjs executes curl -fsSL https://bun.sh/install | bash.
Postinstall also rewrites a dependency file under node_modules.
bin/janex.js repeats unpinned runtime download/execution.

Evidence against

No credential-harvesting or exfiltration path was found in inspected lifecycle code.
MCP configuration writes are limited to ~/.janex, not foreign agent configs.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 257 file(s), 2.29 MB of source, external domains: 127.0.0.1, aka.ms, api.anthropic.com, api.arcee.ai, api.duckduckgo.com, api.example.com, api.fireworks.ai, api.github.com, api.gmi-serving.com, api.groq.com, api.huggingface.co, api.ipify.org, api.kimi.com, api.mail.tm, api.mainnet-beta.solana.com, api.minimax.chat, api.mistral.ai, api.novita.ai, api.openai.com, api.search.brave.com, api.stepfun.ai, api.tavily.com, api.telegram.org, api.together.xyz, api.upstage.ai, api.x.ai, apilayer.net, arb1.arbitrum.io, bsc-dataseed.binance.org, bun.sh, calculator.aws, client-api.arkoselabs.com, cloud.google.com, console.anthropic.com, console.groq.com, dev.to, en.wikipedia.org, eth.llamarpc.com, example.com, export.arxiv.org, facebook.com, github.com, google.serper.dev, haveibeenpwned.com, hn.algolia.com, html.duckduckgo.com, instagram.com, integrate.api.nvidia.com, ip-api.com, linkedin.com

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tools/tempmail/TempMail.jsView file

5patternName = generic_password severity = medium line = 5 matchedText = password...23';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/tools/tempmail/TempMail.jsView on unpkg · L5

bin/janex.jsView file

4import { fileURLToPath } from 'url'; L5: import { spawn, spawnSync, execSync } from 'child_process'; L6: import os from 'os';

High

Child Process

Package source references child process execution.

bin/janex.jsView on unpkg · L4

87? spawnSync( L88: 'powershell.exe', L89: [

High

Shell

Package source references shell execution.

bin/janex.jsView on unpkg · L87

82function installBun() { L83: if (process.env.janex_SKIP_RUNTIME_BOOTSTRAP === '1') return undefined; L84: log('Bun runtime not found — installing Bun for the terminal renderer...'); ... L86: process.platform === 'win32' L87: ? spawnSync( L88: 'powershell.exe', ... L97: ) L98: : spawnSync('bash', ['-c', 'curl -fsSL https://bun.sh/install | bash'], { L99: stdio: 'inherit',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/janex.jsView on unpkg · L82

4import { fileURLToPath } from 'url'; L5: import { spawn, spawnSync, execSync } from 'child_process'; L6: import os from 'os'; L7: L8: const __dirname = dirname(fileURLToPath(import.meta.url)); L9: const rootDir = join(__dirname, '..'); L10: const dist = join(rootDir, 'dist', 'index.js'); L11: const janex_HOME = process.env.janex_STATE_HOME || join(os.homedir(), '.janex'); L12: const MANAGED_NODE_DIR = join(janex_HOME, 'node'); ... L46: if (result.status !== 0) return { major: 0, minor: 0, patch: 0 }; L47: return parseVersion(result.stdout || result.stderr); L48: }

dist/tools/captcha/FuncaptchaSolver.jsView file

14*/ L15: import { createHash, createCipheriv, createDecipheriv, randomBytes } from 'crypto'; L16: import { writeFileSync, unlinkSync, readFileSync } from 'fs'; ... L19: import { loadConfig } from '../../agent/Config.js'; L20: import { request as undiciRequest, ProxyAgent } from 'undici'; L21: // ─── MurmurHash3 x64-128 ─────────────────────────────────────────────────── ... L292: PK: p.ua.includes('Mac OS') ? 'MacIntel' : 'Win32', L293: CFP: 'canvas winding:yes~canvas fp:data:image/png;base64,' + randomBytes(128).toString('base64'), L294: FR: false, ... L677: catch { } L678: const imgPath = join(homedir(), `.janex-funcaptcha-wave-${wave}.png`); L679: writeFileSync(imgPath, imgBuffer);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/captcha/FuncaptchaSolver.jsView on unpkg · L14

bin/janex.cmdView file

•path = bin/janex.cmd kind = build_helper sizeBytes = 1684 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/janex.cmdView on unpkg

skills/research/social-researching/assets/claude-code-rap.mp3View file

•path = skills/research/social-researching/assets/claude-code-rap.mp3 kind = high_entropy_blob sizeBytes = 2354231 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/research/social-researching/assets/claude-code-rap.mp3View on unpkg

skills/skill-comply/tests/test_parser.pyView file

•path = skills/skill-comply/tests/test_parser.py kind = payload_in_excluded_dir sizeBytes = 3230 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skill-comply/tests/test_parser.pyView on unpkg

dist/cli/App.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = janex-agent@1.0.22 matchedIdentity = npm:amFuZXgtYWdlbnQ:1.0.22 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/App.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tools/tempmail/TempMail.jsView file

5patternName = generic_password severity = medium line = 5 matchedText = password...23';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/tools/tempmail/TempMail.jsView on unpkg · L5

Findings

8 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/janex.js

HighShellbin/janex.js

HighSame File Env Network Executionbin/janex.js

HighSandbox Evasion Gated Capabilitybin/janex.js

HighShips High Entropy Blobskills/research/social-researching/assets/claude-code-rap.mp3

HighPayload In Excluded Dirskills/skill-comply/tests/test_parser.py

HighPrevious Version Dangerous Deltadist/cli/App.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/tools/tempmail/TempMail.js

MediumDynamic Requirebin/janex.js

MediumNetwork

Affected versions and remediation

This report applies to janex-agent@1.0.39.

The versions list below shows the verdict for each recorded version.

Avoid installing janex-agent@1.0.39. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-09 11:00:46.105Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

1.0.39latestshownMaliciousRemote Code ExecutionBlockPublishedAug 5, 2026, 8:51 AM 1.0.32SuspiciousRemote Code ExecutionWarnPublishedAug 4, 2026, 8:47 PM 1.0.31MaliciousRemote Code ExecutionBlockPublishedAug 4, 2026, 8:32 PM 1.0.22SuspiciousRemote Code ExecutionWarnPublishedAug 4, 2026, 12:39 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code