registry / Credential exfiltration / wanar-ai

wanar-ai

Wanar AI v1.0.5 - Professional AI Chat Platform + CLI Agent by Wisnu Alfian Nur Ashar & Siti Nurfadhila Az Zahra Syam

This report shows the evidence for wanar-ai@1.0.9. 1 of 6 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This release contains reachable, active attack and secret-extraction functionality without target authorization enforcement. The automatic install hook is limited to its own configuration directory, but it does not mitigate the concrete offensive behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user starts the web server and calls the security attack or extraction routes, or starts a job-agent session.

Impact

An operator can use the package to attack third-party services, retrieve exposed secrets, or bypass anti-automation controls.

Mechanism

Targeted credential spraying, SSRF payload delivery, configuration scraping, and CAPTCHA bypass.

Attack narrative

After the local web server is started, a caller can supply any target to the deep attack and extraction routes. The scanner discovers login pages and attempts common credential combinations, sends SSRF payloads aimed at cloud metadata and internal services, and requests exposed configuration files while collecting credential-like values. The job agent separately tries to solve CAPTCHA challenges automatically. These are active offensive operations rather than passive analysis.

AI rationale

Evidence

src/server.jssrc/security-scanner.jssrc/tools/job-agent.js/.env/wp-config.php/etc/passwd

Network endpoints4

169.254.169.254/latest/meta-data/metadata.google.internal/computeMetadata/v1/100.100.100.200/latest/meta-data/localhost:6379

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The server exposes a deep attack stream that accepts an arbitrary target and invokes the attack engine.
The attack engine sprays common usernames and passwords against discovered login pages.
Deep SSRF tests include cloud metadata services, local services, file reads, and a Redis FLUSHALL payload.
A separate extraction endpoint requests exposed configuration files and collects matching database credentials and API secrets.
The job agent automatically attempts to solve CAPTCHA challenges before submitting applications.
Installation automatically creates a package-owned configuration directory and copies a template environment file.

Evidence against

The offensive actions require a caller to start the local server endpoint and supply a target.
No source evidence shows collected target data being sent to a package-author-controlled host; results are returned to the caller.
The install hook writes only the package-owned ~/.wanar-ai configuration template.

Behavioral surface

Source

ChildProcessCrypto

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/security-scanner.jsView file

5L6: import axios from 'axios'; L7: import fs from 'fs'; ... L11: const __filename = fileURLToPath(import.meta.url); L12: const __dirname = path.dirname(__filename); L13: ... L297: const cleaned = result.content.replace(/```json\s*/g, '').replace(/```\s*/g, '').trim(); L298: const aiResponse = JSON.parse(cleaned); L299: console.log('[AI Analysis] JSON parsed successfully'); ... L1125: try { L1126: await axios.post(target, { L1127: username: username,

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/security-scanner.jsView on unpkg · L5

1163patternName = generic_password severity = medium line = 1163

Medium

Secret Pattern

Package contains a possible secret pattern.

src/security-scanner.jsView on unpkg · L1163

4091patternName = generic_password severity = medium line = 4091

Medium

Secret Pattern