Loading npm security reports…

wanar-ai@1.0.9: Malicious npm security report (Block) | LPM Firewall

registry / wanar-ai / 1.0.9

wanar-ai@1.0.9

Wanar AI v1.0.5 - Professional AI Chat Platform + CLI Agent by Wisnu Alfian Nur Ashar & Siti Nurfadhila Az Zahra Syam

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package exposes unauthenticated local API routes that conduct brute-force login attempts, SSRF probes, and credential-oriented extraction against a caller-supplied target. Its job agent also automates CAPTCHA solving.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user starts the web server and calls the security attack or extraction routes, or starts a job-agent session.

Impact

An operator can use the package to attack third-party services, retrieve exposed secrets, or bypass anti-automation controls.

Mechanism

Targeted credential spraying, SSRF payload delivery, configuration scraping, and CAPTCHA bypass.

Attack narrative

After the local web server is started, a caller can supply any target to the deep attack and extraction routes. The scanner discovers login pages and attempts common credential combinations, sends SSRF payloads aimed at cloud metadata and internal services, and requests exposed configuration files while collecting credential-like values. The job agent separately tries to solve CAPTCHA challenges automatically. These are active offensive operations rather than passive analysis.

Rationale

This release contains reachable, active attack and secret-extraction functionality without target authorization enforcement. The automatic install hook is limited to its own configuration directory, but it does not mitigate the concrete offensive behavior.

Evidence

src/server.jssrc/security-scanner.jssrc/tools/job-agent.js/.env/wp-config.php/etc/passwd

Network endpoints4

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The server exposes a deep attack stream that accepts an arbitrary target and invokes the attack engine.
The attack engine sprays common usernames and passwords against discovered login pages.
Deep SSRF tests include cloud metadata services, local services, file reads, and a Redis FLUSHALL payload.
A separate extraction endpoint requests exposed configuration files and collects matching database credentials and API secrets.
The job agent automatically attempts to solve CAPTCHA challenges before submitting applications.
Installation automatically creates a package-owned configuration directory and copies a template environment file.

Evidence against

The offensive actions require a caller to start the local server endpoint and supply a target.
No source evidence shows collected target data being sent to a package-author-controlled host; results are returned to the caller.
The install hook writes only the package-owned ~/.wanar-ai configuration template.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 70 file(s), 2.42 MB of source, external domains: 100.100.100.200, 127.0.0.1, 169.254.169.254, api-inference.huggingface.co, api.anthropic.com, api.cerebras.ai, api.example.com, api.fireworks.ai, api.groq.com, api.hyperbolic.xyz, api.openai.com, api.sambanova.ai, api.together.xyz, api.vector.dev, api.vectorengine.ai, app.hyperbolic.xyz, attacker.com, cloud.sambanova.ai, cognimail.zenime.my.id, crt.sh, dns.google, evil.com, fireworks.ai, generativelanguage.googleapis.com, github.com, glints.com, hargakita.netlify.app, huggingface.co, inference.cerebras.ai, integrate.api.nvidia.com, linkedin.com, metadata.google.internal, openagentic.id, reactjs.org, target.com, www.ashargrosirparfum.com, www.baidu.com, www.bing.com, www.exploit-db.com, www.google.com, www.jobstreet.co.id, www.kalibrr.id, www.linkedin.com, www.w3.org, www.wisnualfiannurashar.my.id, yandex.com

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/security-scanner.jsView file

5L6: import axios from 'axios'; L7: import fs from 'fs'; ... L11: const __filename = fileURLToPath(import.meta.url); L12: const __dirname = path.dirname(__filename); L13: ... L297: const cleaned = result.content.replace(/```json\s*/g, '').replace(/```\s*/g, '').trim(); L298: const aiResponse = JSON.parse(cleaned); L299: console.log('[AI Analysis] JSON parsed successfully'); ... L1125: try { L1126: await axios.post(target, { L1127: username: username,

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/security-scanner.jsView on unpkg · L5

1163patternName = generic_password severity = medium line = 1163

Medium

Secret Pattern

Package contains a possible secret pattern.

src/security-scanner.jsView on unpkg · L1163

4091patternName = generic_password severity = medium line = 4091

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4091

4120patternName = generic_password severity = medium line = 4120

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4120

4223patternName = generic_password severity = medium line = 4223

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4223

4265patternName = generic_password severity = medium line = 4265

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4265

4311patternName = generic_password severity = medium line = 4311

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4311

4391patternName = generic_password severity = medium line = 4391

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4391

5368patternName = generic_password severity = medium line = 5368

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L5368

client/dist/assets/index-CkgxO0D6.jsView file

108`+(s.tokens?this.parseInline(s.tokens):s.text);r+=n?this.renderer.paragraph(l):l;continue}default:{const s='Token with "'+i.type+'" type was not found.';if(this.options.silent)retu... L109: Please report this to https://github.com/markedjs/marked.`,e){const a="<p>An error occurred:</p><pre>"+vt(r.message+"",!0)+"</pre>";return n?Promise.resolve(a):a}if(n)return Promis... L110: https://github.com/highlightjs/highlight.js/issues/2277`),F=D,w=U),P===void 0&&(P=!0);const V={code:w,language:F};ie("before:highlight",V);const L=V.result?V.result:_(V.language,V....

High

Child Process

Package source references child process execution.

client/dist/assets/index-CkgxO0D6.jsView on unpkg · L108

112`},g]}}return pc=a,pc}var mc,HE;function wI(){if(HE)return mc;HE=1;function t(e){const n="[a-zA-Z_][\\w.]*",r="<\\?(lasso(script)?|=)",a="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L113: ]`,b={scope:"string",variants:[_,u,p,f]},S={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L114: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return Nd=t,Nd}var Od,aS;function WA(){if(aS)return Od;aS=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",r={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

client/dist/assets/index-CkgxO0D6.jsView on unpkg · L112

src/ai-manager.jsView file

86- JANGAN pernah bilang "saya tidak bisa mengakses" sebelum mencoba L87: - Jobstreet Indonesia: https://www.jobstreet.co.id/jobs L88: - Glints: https://glints.[redacted] ... L326: - **XSS**: Reflected, Stored, DOM-based L327: - **Insecure Deserialization**: eval(), unserialize dari user input L328: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE ... L392: - ....//....//etc/passwd (bypass filter) L393: - Wrapper exploitation (php://filter, data://) L394: L395: **Command Injection** L396: - ; cat /etc/passwd L397: - | whoami

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/ai-manager.jsView on unpkg · L86

326- **XSS**: Reflected, Stored, DOM-based L327: - **Insecure Deserialization**: eval(), unserialize dari user input L328: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/ai-manager.jsView on unpkg · L326

src/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = wanar-ai@1.0.7 matchedIdentity = npm:d2FuYXItYWk:1.0.7 similarity = 0.897 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server.jsView on unpkg

1498app.post('/api/job-agent/launch-chrome', asyncHandler(async (req, res) => { L1499: const { execSync, spawn } = await import('child_process'); L1500: ... L1502: try { L1503: const cdpRes = await fetch('http://localhost:9222/json/version', { signal: AbortSignal.timeout(1500) }); L1504: if (cdpRes.ok) { ... L1512: 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe', L1513: `C:\\Users\\${process.env.USERNAME}\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe`, L1514: ];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/server.jsView on unpkg · L1498

src/tools/job-agent.jsView file

121const origin = new URL(url).origin; L122: const res = await fetch(`${origin}/robots.txt`).catch(() => null); L123: if (!res || !res.ok) return true; L124: const text = await res.text(); L125: if (/disallow.*\/apply|disallow.*\/jobs.*apply/i.test(text)) return false; ... L206: const base64Audio = audioBuffer.toString('base64'); L207: const googleSpeechKey = process.env.GOOGLE_SPEECH_API_KEY; L208: if (!googleSpeechKey) { ... L216: headers: { 'Content-Type': 'audio/x-flac; rate=16000' }, L217: body: audioBuffer, L218: } ... L318: // PENTING: Google Forms memiliki elemen Google Account di header —

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

src/tools/job-agent.jsView on unpkg · L121

121Trigger-reachable credential exfiltration chain: scripts.dev -> src/server.js -> src/tools/job-agent.js L121: const origin = new URL(url).origin; L122: const res = await fetch(`${origin}/robots.txt`).catch(() => null); L123: if (!res || !res.ok) return true; L124: const text = await res.text(); L125: if (/disallow.*\/apply|disallow.*\/jobs.*apply/i.test(text)) return false; ... L206: const base64Audio = audioBuffer.toString('base64'); L207: const googleSpeechKey = process.env.GOOGLE_SPEECH_API_KEY; L208: if (!googleSpeechKey) { ... L216: headers: { 'Content-Type': 'audio/x-flac; rate=16000' }, L217: body: audioBuffer, L218: } ... L318: // PENTING: Google Forms memiliki elemen Google Account di header —

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

src/tools/job-agent.jsView on unpkg · L121

Source & flagged code

19 flagged

package.jsonView file

Lines 8-48json

8 "wanar": "bin/wanar.js",

9 "wanarai": "bin/wanarai.js"

10 },

11 "files": [

12 "src/",

13 "bin/",

14 "config/",

15 "scripts/",

16 "client/dist/",

17 ".env.example",

18 "README.md"

19 ],

20 "scripts": {

21 "start": "node src/index.js",

22 "cli": "node src/cli.js",

23 "web": "node src/server.js",

24 "test": "node src/test.js",

25 "dev": "node --watch src/server.js",

26 "analytics": "node src/tools/health-cli.js",

27 "analytics:legacy": "node src/tools/analytics-cli.js",

28 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "keywords": [

31 "ai",

32 "agent",

33 "enterprise",

34 "openagentic",

35 "nvidia",

36 "vector",

37 "multi-provider",

38 "intelligent-routing",

39 "context-management",

40 "semantic-cache",

41 "analytics",

42 "chatbot",

43 "cli",

44 "terminal"

45 ],

46 "author": "Wisnu Alfian Nur Ashar",

47 "license": "MIT",

48 "repository": {

src/security-scanner.jsView file

Lines 1143-1183javascript

1143 }

1144

1145 } catch (error) {

1146 test.result = 'error';

1147 test.details.push(`Test error: ${error.message}`);

1148 }

1149

client/dist/assets/index-CkgxO0D6.jsView file

108`+(s.tokens?this.parseInline(s.tokens):s.text);r+=n?this.renderer.paragraph(l):l;continue}default:{const s='Token with "'+i.type+'" type was not found.';if(this.options.silent)retu... L109: Please report this to https://github.com/markedjs/marked.`,e){const a="<p>An error occurred:</p><pre>"+vt(r.message+"",!0)+"</pre>";return n?Promise.resolve(a):a}if(n)return Promis... L110: https://github.com/highlightjs/highlight.js/issues/2277`),F=D,w=U),P===void 0&&(P=!0);const V={code:w,language:F};ie("before:highlight",V);const L=V.result?V.result:_(V.language,V....

High

Child Process

Package source references child process execution.

client/dist/assets/index-CkgxO0D6.jsView on unpkg · L108

112`},g]}}return pc=a,pc}var mc,HE;function wI(){if(HE)return mc;HE=1;function t(e){const n="[a-zA-Z_][\\w.]*",r="<\\?(lasso(script)?|=)",a="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L113: ]`,b={scope:"string",variants:[_,u,p,f]},S={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L114: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return Nd=t,Nd}var Od,aS;function WA(){if(aS)return Od;aS=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",r={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

client/dist/assets/index-CkgxO0D6.jsView on unpkg · L112

src/ai-manager.jsView file

Lines 306-346javascript

306 - Closure salah tangkap variabel di loop

307 - Mutasi object/array tidak disengaja

308 - == vs === issues

309 - Memory leak dari event listener tidak di-cleanup

310

3113.

src/server.jsView file

Lines 1478-1518javascript

1478

1479// POST /api/job-agent/sessions/:id/start — mulai crawl & apply

1480app.post('/api/job-agent/sessions/:id/start', asyncHandler(async (req, res) => {

1481 const id = Number

src/tools/job-agent.jsView file

Lines 101-141javascript

101 for (const mapping of FIELD_MAP) {

102 if (mapping.patterns.some(p => p.test(normalized))) {

103 const value