xyt-agentos@1.1.3
XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an obfuscated agent-management client with an unprompted install-time persistence action and runtime cross-agent extension capability. No concrete install-time AI-agent takeover, credential theft, or exfiltration chain was confirmed.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install triggers the PATH edit; CLI/SDK runtime operations trigger agent integration.
Impact
Shell startup configuration is changed without an explicit setup command; runtime use can modify AI-agent extension locations.
Mechanism
install-time shell-profile mutation plus runtime agent-skill synchronization
AI rationale
This is an obfuscated agent-management client with an unprompted install-time persistence action and runtime cross-agent extension capability. No concrete install-time AI-agent takeover, credential theft, or exfiltration chain was confirmed.
Evidence
package.jsonscripts/postinstall.mjsdist/index.jsdist/socket-server.jsdist/cli.js~/.zshrc~/.bash_profile~/.profile~/.codex~/.claude~/.cursor
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Install hook runs automatically and edits shell startup files.
- Obfuscated runtime manages skills under foreign AI-agent directories including .codex and .claude.
- Runtime can synchronize downloaded skills into agent control surfaces.
Evidence against
- The install hook only changes PATH; it does not access agent directories or network.
- No concrete credential exfiltration or remote-payload execution was established from the inspected source.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/socket-server.jsView file
1#!/usr/bin/env node
L2: const _0x5db090=_0x2c4f;(function(_0x46774a,_0x5c368b){const _0x459a0c={_0x49a527:0x1d1,_0x538508:0x923,_0x3c25f2:0x2c2,_0x259329:0xa05,_0x5bb061:0xa02,_0xc58db8:0x90b},_0x5de1f7=_...
High
Child Process
Package source references child process execution.
dist/socket-server.jsView on unpkg · L1Findings
9 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/socket-server.js
HighShell
HighSame File Env Network Executiondist/socket-server.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/socket-server.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencescripts/postinstall.mjs
HighObfuscated
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to xyt-agentos@1.1.3.
See all versions of xyt-agentos for other recorded verdicts.
- Review the evidence and your use of xyt-agentos@1.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.