Loading npm security reports…

vanexa-agent@1.1.11: Malicious npm security report (Block) | LPM Firewall

registry / vanexa-agent / 1.1.11

vanexa-agent@1.1.11

Sovereign AI Agent Desktop Daemon

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10751 confirms this npm version as malicious. When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay at wss://vanexa-agent-relay.hanazaki542.workers.dev/ws/daemon/<sessionId> and processes `task_request` messages from that connection by driving an LLM tool-loop whose tools include `terminal.exec` and `terminal.exec_background`, which invoke `spawn('/bin/bash', ['-c', args.command])` (or `cmd.exe...

Advisory

MAL-2026-10751

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in vanexa-agent (npm)

Details

When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay at wss://vanexa-agent-relay.hanazaki542.workers.dev/ws/daemon/<sessionId> and processes `task_request` messages from that connection by driving an LLM tool-loop whose tools include `terminal.exec` and `terminal.exec_background`, which invoke `spawn('/bin/bash', ['-c', args.command])` (or `cmd.exe /c...` on Windows) on the installer's host. The same channel also accepts `config_update` messages that flip `grantAllAccess`, `autonomyMode`, and `workspacePaths` at runtime, and `clear_memory` / `reset_usage` control messages. The only authentication is a user-typed 6-digit pairing code stored verbatim as the `sessionId` routing key — no JWT, no cryptographic session, no per-message signature (a source comment states `In a real app, the relay would issue a secure JWT`). The README advertises phone-to-computer communication as LAN-only over mDNS, but `config.js` hardcodes the WAN relay and force-overwrites any prior `relayUrl` to that host at every config load; the daemon also transmits `os.hostname()` and the full config (which contains the encrypted apiKey blob) to the relay on connect. Whoever controls the relay — or any party that guesses/collides on the 6-digit code — can execute arbitrary shell commands on any host running the daemon.

Decision reason

No blocking static signals were detected.

References

Source & flagged code

6 flagged · loading source

src/tools/registry.jsView file

74const modulePath = "file://" + path.join(CUSTOM_TOOLS_DIR, file); L75: const imported = await import(modulePath + `?t=${Date.now()}`); // Cache busting for hot-reload L76: // Find the exported tool object

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/registry.jsView on unpkg · L74

src/tools/executeProceduralMedia.jsView file

2import path from 'path'; L3: import { exec } from 'child_process'; L4: import util from 'util'; ... L27: const { code, language } = args; L28: let outputFilePath = args.outputFileName.replace(/^~\//, os.homedir() + '/'); L29: outputFilePath = path.resolve(outputFilePath); ... L67: if (fs.existsSync(scriptPath)) fs.unlinkSync(scriptPath); L68: return { success: false, error: `[AUTO-CORRECTION REQUIRED] Python Execution Error: ${pyError.message || pyError.stderr}\nPlease fix the math/syntax and retry.` }; L69: }

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/tools/executeProceduralMedia.jsView on unpkg · L2

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6517 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

vanexa-agent-1.0.0.tgzView file

•path = vanexa-agent-1.0.0.tgz kind = high_entropy_blob sizeBytes = 17797 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vanexa-agent-1.0.0.tgzView on unpkg

•path = vanexa-agent-1.0.0.tgz kind = compressed_blob sizeBytes = 17797 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vanexa-agent-1.0.0.tgzView on unpkg

•path = vanexa-agent-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 17797 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vanexa-agent-1.0.0.tgzView on unpkg

Source & flagged code

6 flagged

src/tools/registry.jsView file

Lines 54-94javascript

54];

55

56// Base static definitions (backwards compatible)

57export const TOOL_DEFINITIONS = rawTools

58 .filter(validateSchema)

59 .map(schema => ({

60 ...schema,

61 name: schema.name.replace(/\./g, '_')

62 }));

63

64// Phase 6 AGI Upgrade & V5 Cortex: Dynamic Tool Culling and Hot-Reloading Engine

65export async function getDynamicTools(autonomyMode = 'C', supportsVision = true) {

66 let tools = [...TOOL_DEFINITIONS];

67

68 // V5: Dynamically scan and load forged tools

69 const CUSTOM_TOOLS_DIR = path.join(os.homedir(), '.vanexa', 'custom_tools');

70 if (fs.existsSync(CUSTOM_TOOLS_DIR)) {

71 const files = fs.readdirSync(CUSTOM_TOOLS_DIR).filter(f => f.endsWith('.js'));

72 for (const file of files) {

73 try {

74 const modulePath = "file://" + path.join(CUSTOM_TOOLS_DIR, file);

75 const imported = await import(modulePath + `?t=${Date.now()}`); // Cache busting for hot-reload

76 // Find the exported tool object

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/registry.jsView on unpkg · L74

77 for (const key of Object.keys(imported)) {

78 if (imported[key] && imported[key].schema) {

79 tools.push({

80 ...imported[key].schema,

81 name: imported[key].schema.name.replace(/\./g, '_')

82 });

83 // Auto-register to runtime registry if not exists

84 if (!toolRegistry[imported[key].schema.name.replace(/\./g, '_')]) {

85 toolRegistry[imported[key].schema.name.replace(/\./g, '_')] = imported[key];

86 }

87 }

88 }

89 } catch (e) {

90 console.error(`[TOOL FORGE] Failed to load custom tool ${file}:`, e.message);

91 }

92 }

93 }

94

src/tools/executeProceduralMedia.jsView file

Lines 1-22javascript

1import fs from 'fs';

2import path from 'path';

3import { exec } from 'child_process';

4import util from 'util';

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6517 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

vanexa-agent-1.0.0.tgzView file

•path = vanexa-agent-1.0.0.tgz kind = high_entropy_blob sizeBytes = 17797 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vanexa-agent-1.0.0.tgzView on unpkg

•path = vanexa-agent-1.0.0.tgz kind = compressed_blob sizeBytes = 17797 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vanexa-agent-1.0.0.tgzView on unpkg

•path = vanexa-agent-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 17797 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vanexa-agent-1.0.0.tgzView on unpkg