janex-agent@1.0.39: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

janex-agent@1.0.39: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tools/tempmail/TempMail.jsView file

5patternName = generic_password severity = medium line = 5 matchedText = password...23';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/tools/tempmail/TempMail.jsView on unpkg · L5

bin/janex.jsView file

4import { fileURLToPath } from 'url'; L5: import { spawn, spawnSync, execSync } from 'child_process'; L6: import os from 'os';

High

Child Process

Package source references child process execution.

bin/janex.jsView on unpkg · L4

87? spawnSync( L88: 'powershell.exe', L89: [

High

Shell

Package source references shell execution.

bin/janex.jsView on unpkg · L87

82function installBun() { L83: if (process.env.janex_SKIP_RUNTIME_BOOTSTRAP === '1') return undefined; L84: log('Bun runtime not found — installing Bun for the terminal renderer...'); ... L86: process.platform === 'win32' L87: ? spawnSync( L88: 'powershell.exe', ... L97: ) L98: : spawnSync('bash', ['-c', 'curl -fsSL https://bun.sh/install | bash'], { L99: stdio: 'inherit',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/janex.jsView on unpkg · L82

4import { fileURLToPath } from 'url'; L5: import { spawn, spawnSync, execSync } from 'child_process'; L6: import os from 'os'; L7: L8: const __dirname = dirname(fileURLToPath(import.meta.url)); L9: const rootDir = join(__dirname, '..'); L10: const dist = join(rootDir, 'dist', 'index.js'); L11: const janex_HOME = process.env.janex_STATE_HOME || join(os.homedir(), '.janex'); L12: const MANAGED_NODE_DIR = join(janex_HOME, 'node'); ... L46: if (result.status !== 0) return { major: 0, minor: 0, patch: 0 }; L47: return parseVersion(result.stdout || result.stderr); L48: }

dist/tools/captcha/FuncaptchaSolver.jsView file

14*/ L15: import { createHash, createCipheriv, createDecipheriv, randomBytes } from 'crypto'; L16: import { writeFileSync, unlinkSync, readFileSync } from 'fs'; ... L19: import { loadConfig } from '../../agent/Config.js'; L20: import { request as undiciRequest, ProxyAgent } from 'undici'; L21: // ─── MurmurHash3 x64-128 ─────────────────────────────────────────────────── ... L292: PK: p.ua.includes('Mac OS') ? 'MacIntel' : 'Win32', L293: CFP: 'canvas winding:yes~canvas fp:data:image/png;base64,' + randomBytes(128).toString('base64'), L294: FR: false, ... L677: catch { } L678: const imgPath = join(homedir(), `.janex-funcaptcha-wave-${wave}.png`); L679: writeFileSync(imgPath, imgBuffer);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/captcha/FuncaptchaSolver.jsView on unpkg · L14

bin/janex.cmdView file

•path = bin/janex.cmd kind = build_helper sizeBytes = 1684 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/janex.cmdView on unpkg

skills/research/social-researching/assets/claude-code-rap.mp3View file

•path = skills/research/social-researching/assets/claude-code-rap.mp3 kind = high_entropy_blob sizeBytes = 2354231 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/research/social-researching/assets/claude-code-rap.mp3View on unpkg

skills/skill-comply/tests/test_parser.pyView file

•path = skills/skill-comply/tests/test_parser.py kind = payload_in_excluded_dir sizeBytes = 3230 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skill-comply/tests/test_parser.pyView on unpkg

dist/cli/App.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = janex-agent@1.0.22 matchedIdentity = npm:amFuZXgtYWdlbnQ:1.0.22 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/App.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "janex-agent",

3 "version": "1.0.39",

4 "type": "module",

5 "description": "Autonomous Multi-Agent AI Workspace in your terminal. Codes, researches, and executes real tasks with 40+ tools and 280+ skills",

6 "main": "dist/index.js",

7 "bin": {

8 "janex": "./bin/janex.js"

9 },

10 "scripts": {

11 "build": "node scripts/build.cjs",

12 "dev": "tsx src/index.tsx",

13 "start": "node dist/index.js",

14 "prepare": "npm run build",

15 "lint": "eslint src/**/*.ts",

16 "format": "prettier --write \"src/**/*.ts\"",

17 "test": "node node_modules/vitest/vitest.mjs run",

18 "test:watch": "node node_modules/vitest/vitest.mjs",

19 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 },

21 "keywords": [

22 "ai",

23 "agent",

24 "automation",

25 "terminal",

26 "multi-agent",

27 "browser",

28 "captcha",

29 "ctf",

30 "research"

31 ],

32 "author": "Janex",

33 "license": "MIT",

34 "dependencies": {

35 "@ai-sdk/anthropic": "^4.0.29",

36 "@ai-sdk/openai": "^4.0.29",

37 "@anthropic-ai/sdk": "0.35.0",

38 "@fastify/cors": "11.2.0",

39 "@modelcontextprotocol/sdk": "1.30.0",

dist/tools/tempmail/TempMail.jsView file

Lines 1-25javascript

1import { fetch } from 'undici';

2export class TempMail {

3 address = '';

4 token = ''

bin/janex.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, readFileSync, rmSync } from 'fs';

3import { join, dirname } from 'path';

4import { fileURLToPath } from 'url';

5import { spawn, spawnSync, execSync } from

dist/tools/captcha/FuncaptchaSolver.jsView file

Lines 1-34javascript

1/**

2 * FunCaptcha (Arkose Labs) solver — API-level approach.

3 *

4 * Ported and integrated from:

5 * - noahcoolboy/funcaptcha (BDA fingerprint generation, session/challenge API, crypto, api-breakers)

6 * - useragents/Funcaptcha-Audio-Solver (audio challenge flow + speech-to-text)

7 *

8 * This module does NOT require a browser. It speaks directly to the Arkose

9 * Labs API: generate BDA → get token → get challenge → solve (audio or

10 * vision). The solved token is then injected back into the page.

bin/janex.cmdView file

•path = bin/janex.cmd kind = build_helper sizeBytes = 1684 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/janex.cmdView on unpkg

skills/research/social-researching/assets/claude-code-rap.mp3View file

•path = skills/research/social-researching/assets/claude-code-rap.mp3 kind = high_entropy_blob sizeBytes = 2354231 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/research/social-researching/assets/claude-code-rap.mp3View on unpkg

skills/skill-comply/tests/test_parser.pyView file

•path = skills/skill-comply/tests/test_parser.py kind = payload_in_excluded_dir sizeBytes = 3230 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skill-comply/tests/test_parser.pyView on unpkg

dist/cli/App.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = janex-agent@1.0.22 matchedIdentity = npm:amFuZXgtYWdlbnQ:1.0.22 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/App.jsView on unpkg

Lines 62-125javascript

62 if (process.platform === 'win32') {

63 if (process.env.USERPROFILE) candidates.push(join(process.env.USERPROFILE, '.bun', 'bin', 'bun.exe'));

64 if (process.env.LOCALAPPDATA) candidates.push(join(process.env.LOCALAPPDATA, 'bun', 'bun.exe'));

65 } else {

66 candidates.push(join(os.homedir(), '.bun', 'bin', 'bun'));

67 }

68 return candidates;

69}

70

71function findBun() {

72 for (const candidate of bunExecutableCandidates()) {

73 const result = spawnSync(candidate, ['--version'], {

74 stdio: 'ignore',

75 shell: candidate === 'bun' && process.platform === 'win32',

76 });

77 if (result.status === 0) return candidate;

78 }

79 return undefined;

80}

81

82function installBun() {

83 if (process.env.janex_SKIP_RUNTIME_BOOTSTRAP === '1') return undefined;

84 log('Bun runtime not found — installing Bun for the terminal renderer...');

85 const result =

86 process.platform === 'win32'

87 ? spawnSync(

88 'powershell.exe',

89 [

High

Shell

Package source references shell execution.

bin/janex.jsView on unpkg · L87

90 '-NoProfile',

91 '-ExecutionPolicy',

92 'Bypass',

93 '-Command',

94 'irm bun.sh/install.ps1 | iex',

95 ],

96 { stdio: 'inherit' },

97 )

98 : spawnSync('bash', ['-c', 'curl -fsSL https://bun.sh/install | bash'], {

99 stdio: 'inherit',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/janex.jsView on unpkg · L82

100 });

101 if (result.status !== 0) return undefined;

102 return findBun();

103}

104

105function nodeHasFfi(bin) {

106 const probe = spawnSync(bin, ['-e', 'require("node:ffi")'], {

107 stdio: 'ignore',

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/janex.jsView on unpkg · L105

108 shell: false,

109 });

110 if (probe.status === 0) return true;

111 const withFlag = spawnSync(bin, ['--experimental-ffi', '-e', '0'], {

112 stdio: 'ignore',

113 shell: false,

114 });

115 return withFlag.status === 0;

116}

117

118function fetchText(url) {

119 const script = `

120 const https = require('https');

121 https.get(${JSON.stringify(url)}, (res) => {

122 if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {

123 https.get(res.headers.location, (r) => r.pipe(process.stdout)).on('error', () => process.exit(1));

124 return;

125 }