Loading npm security reports…

xyt-agentos@1.0.5: Malicious npm security report (Block) | LPM Firewall

registry / xyt-agentos / 1.0.5

xyt-agentos@1.0.5

XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The runtime starts a desktop client that scans AI-agent conversation/state stores and uploads archives. This is not necessary for an npm library import and is concealed by heavy obfuscation.

Static reason

One or more suspicious static signals were detected.

Trigger

Import dist/index.js or run xyt-client/start the desktop client.

Impact

Exfiltration of AI-agent conversations, project/session state, and potentially sensitive content.

Mechanism

background agent-data collection and archive upload

Attack narrative

On package runtime, dist/index.js invokes its desktop-client bootstrap. The client schedules scans of Codex, Claude, Cursor, OpenClaw, and its own agent records. In dist/cli.js, Codex session data and state databases are placed in ZIP archives and sent to an API path ending in /dialogue/upload; analogous upload routines exist for other agent stores. The behavior is heavily obfuscated and lacks a narrow, user-selected export boundary.

Rationale

Source establishes a concrete collection-and-upload chain for foreign AI-agent session/state data. No install hook reduces install-time impact but does not negate runtime exfiltration.

Evidence

package.jsondist/index.jsdist/cli.jsdist/socket-server.js~/.codex/sessions~/.cursor/User/globalStorage/state.vscdb

Decision evidence

public snapshot

Source & flagged code

5 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: const _0x2e97f8=_0x2a78;(function(_0x5f065f,_0x2b93af){const _0x3730cc={_0x5e3721:0xaae,_0x35225f:0xde9,_0x1ccd1a:0xf6f,_0x10b4ce:0x69a,_0x34e1fa:0xd81},_0x8b05c0=_0x2a78,_0x264c23...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/socket-server.jsView file

1#!/usr/bin/env node L2: const _0xa48297=_0x3550;(function(_0x1915d9,_0x1c0d48){const _0x2ab9b5={_0x7a91bb:0xcc3,_0x269d17:0x885,_0x489beb:0xaa3,_0x6f30a1:0xc7a,_0x1ea7d7:0x3b6},_0x3ca150=_0x3550,_0x143934...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0xa48297=_0x3550;(function(_0x1915d9,_0x1c0d48){const _0x2ab9b5={_0x7a91bb:0xcc3,_0x269d17:0x885,_0x489beb:0xaa3,_0x6f30a1:0xc7a,_0x1ea7d7:0x3b6},_0x3ca150=_0x3550,_0x143934...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L1

dist/cli.jsView file

1#!/usr/bin/env node L2: const _0x2b6868=_0x172a;(function(_0x42b528,_0x4d30f7){const _0x1d5b40={_0x41a865:0x328,_0x2feab5:0x10d1,_0x298fc7:0x9e9,_0x99091:0x175a,_0x56e25d:0xf51,_0x3edd4a:0x614,_0x447580:0...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.js L1: #!/usr/bin/env node L2: const _0x2b6868=_0x172a;(function(_0x42b528,_0x4d30f7){const _0x1d5b40={_0x41a865:0x328,_0x2feab5:0x10d1,_0x298fc7:0x9e9,_0x99091:0x175a,_0x56e25d:0xf51,_0x3edd4a:0x614,_0x447580:0...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L1

Source & flagged code

5 flagged

dist/index.jsView file

1#!/usr/bin/env node L2: const _0x2e97f8=_0x2a78;(function(_0x5f065f,_0x2b93af){const _0x3730cc={_0x5e3721:0xaae,_0x35225f:0xde9,_0x1ccd1a:0xf6f,_0x10b4ce:0x69a,_0x34e1fa:0xd81},_0x8b05c0=_0x2a78,_0x264c23...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/socket-server.jsView file

1#!/usr/bin/env node L2: const _0xa48297=_0x3550;(function(_0x1915d9,_0x1c0d48){const _0x2ab9b5={_0x7a91bb:0xcc3,_0x269d17:0x885,_0x489beb:0xaa3,_0x6f30a1:0xc7a,_0x1ea7d7:0x3b6},_0x3ca150=_0x3550,_0x143934...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0xa48297=_0x3550;(function(_0x1915d9,_0x1c0d48){const _0x2ab9b5={_0x7a91bb:0xcc3,_0x269d17:0x885,_0x489beb:0xaa3,_0x6f30a1:0xc7a,_0x1ea7d7:0x3b6},_0x3ca150=_0x3550,_0x143934...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L1

dist/cli.jsView file

1#!/usr/bin/env node L2: const _0x2b6868=_0x172a;(function(_0x42b528,_0x4d30f7){const _0x1d5b40={_0x41a865:0x328,_0x2feab5:0x10d1,_0x298fc7:0x9e9,_0x99091:0x175a,_0x56e25d:0xf51,_0x3edd4a:0x614,_0x447580:0...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.js L1: #!/usr/bin/env node L2: const _0x2b6868=_0x172a;(function(_0x42b528,_0x4d30f7){const _0x1d5b40={_0x41a865:0x328,_0x2feab5:0x10d1,_0x298fc7:0x9e9,_0x99091:0x175a,_0x56e25d:0xf51,_0x3edd4a:0x614,_0x447580:0...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L1