Loading npm security reports…

xyt-agentos@1.0.4: Malicious npm security report (Block) | LPM Firewall

registry / xyt-agentos / 1.0.4

xyt-agentos@1.0.4

XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The runtime client scans other AI-agent workspaces and periodically uploads dialogues, metadata, skills, and workspace changes to its configured API/WebSocket service. It also accesses agent session/configuration material.

Static reason

One or more suspicious static signals were detected.

Trigger

Running xyt-client or executing dist/index.js

Impact

Exfiltration of AI-agent conversations, workspace metadata/files, and session-related data.

Mechanism

obfuscated AI-agent data collection and periodic remote upload

Attack narrative

When the package runtime is started, it establishes a desktop-client connection, scans supported agent installations, and starts periodic upload routines. The code explicitly handles Claude, Codex, Cursor, XYT, and OpenClaw dialogue records plus workspace and skill data, while reading agent configuration/session material. Obfuscation prevents meaningful informed consent and hides the destination behind a configurable API URL.

Rationale

This is concrete cross-agent data collection and remote upload, not merely user-requested local command execution. The lack of install hooks limits installation impact but does not remove the malicious runtime exfiltration chain.

Evidence

package.jsondist/cli.jsdist/index.jsdist/socket-server.js.claude.cursor.agentsAGENTS.md

Decision evidence

public snapshot

Source & flagged code

5 flagged · loading source

dist/socket-server.jsView file

1#!/usr/bin/env node L2: const _0x476cfa=_0x5b9c;(function(_0xdfee70,_0xde162a){const _0x411ce2={_0x92d853:0xb52,_0x34ed04:0x2fb,_0xd1e786:0x54f},_0xbb4ac6=_0x5b9c,_0x85fea1=_0xdfee70();while(!![]){try{con...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x476cfa=_0x5b9c;(function(_0xdfee70,_0xde162a){const _0x411ce2={_0x92d853:0xb52,_0x34ed04:0x2fb,_0xd1e786:0x54f},_0xbb4ac6=_0x5b9c,_0x85fea1=_0xdfee70();while(!![]){try{con...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x476cfa=_0x5b9c;(function(_0xdfee70,_0xde162a){const _0x411ce2={_0x92d853:0xb52,_0x34ed04:0x2fb,_0xd1e786:0x54f},_0xbb4ac6=_0x5b9c,_0x85fea1=_0xdfee70();while(!![]){try{con...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/socket-server.jsView on unpkg · L1

dist/cli.jsView file

1#!/usr/bin/env node L2: const _0x4ab008=_0x2dec;(function(_0x2ef619,_0x4bd20c){const _0x58bd40={_0x23050b:0x4ac,_0x1d6bee:0x65e,_0x3e7c4a:0x763,_0x24269a:0xaf6,_0x5abd19:0x13cd,_0x1df358:0x16e4,_0x336a93:...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.js L1: #!/usr/bin/env node L2: const _0x4ab008=_0x2dec;(function(_0x2ef619,_0x4bd20c){const _0x58bd40={_0x23050b:0x4ac,_0x1d6bee:0x65e,_0x3e7c4a:0x763,_0x24269a:0xaf6,_0x5abd19:0x13cd,_0x1df358:0x16e4,_0x336a93:...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L1

Source & flagged code

5 flagged

dist/socket-server.jsView file

1#!/usr/bin/env node L2: const _0x476cfa=_0x5b9c;(function(_0xdfee70,_0xde162a){const _0x411ce2={_0x92d853:0xb52,_0x34ed04:0x2fb,_0xd1e786:0x54f},_0xbb4ac6=_0x5b9c,_0x85fea1=_0xdfee70();while(!![]){try{con...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x476cfa=_0x5b9c;(function(_0xdfee70,_0xde162a){const _0x411ce2={_0x92d853:0xb52,_0x34ed04:0x2fb,_0xd1e786:0x54f},_0xbb4ac6=_0x5b9c,_0x85fea1=_0xdfee70();while(!![]){try{con...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x476cfa=_0x5b9c;(function(_0xdfee70,_0xde162a){const _0x411ce2={_0x92d853:0xb52,_0x34ed04:0x2fb,_0xd1e786:0x54f},_0xbb4ac6=_0x5b9c,_0x85fea1=_0xdfee70();while(!![]){try{con...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/socket-server.jsView on unpkg · L1

dist/cli.jsView file

1#!/usr/bin/env node L2: const _0x4ab008=_0x2dec;(function(_0x2ef619,_0x4bd20c){const _0x58bd40={_0x23050b:0x4ac,_0x1d6bee:0x65e,_0x3e7c4a:0x763,_0x24269a:0xaf6,_0x5abd19:0x13cd,_0x1df358:0x16e4,_0x336a93:...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.js L1: #!/usr/bin/env node L2: const _0x4ab008=_0x2dec;(function(_0x2ef619,_0x4bd20c){const _0x58bd40={_0x23050b:0x4ac,_0x1d6bee:0x65e,_0x3e7c4a:0x763,_0x24269a:0xaf6,_0x5abd19:0x13cd,_0x1df358:0x16e4,_0x336a93:...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L1