registry / Persistence / xyt-agentos / 1.1.6

xyt-agentos@1.1.6

XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic profile mutation and service persistence are concrete and high-risk, but inspected source does not establish malicious exfiltration, remote execution, or foreign AI-agent hijacking. Warn rather than block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Persistent execution of xyt-client after installation.

Mechanism

shell-profile mutation and persistent client service setup

AI rationale

Evidence

package.jsonscripts/postinstall.mjsscripts/agentos-watchdog.shdist/socket-server.js~/.zshrc~/.bash_profile~/.profile

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

postinstall unconditionally edits shell profiles.
postinstall invokes its persistent service installer.
Bundled watchdog restarts xyt-client.
Obfuscated runtime fetches skill content with API credentials.

Evidence against

No network activity appears in postinstall.
Lifecycle code targets this package's client, not a foreign agent config.
Claude skill operations appear runtime/API-driven, not lifecycle-triggered.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscated

Manifest

NoLicense

scanned 4 file(s), 3.39 MB of source

Source & flagged code

11 flagged

package.jsonView file

Lines 1-40json

2 "name": "xyt-agentos",

3 "version": "1.1.6",

4 "description": "XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）",

5 "type": "module",

6 "main": "dist/index.js",

7 "exports": {

8 ".": "./dist/index.js",

9 "./sdk": "./dist/socket-server.js"

10 },

11 "bin": {

12 "xyt-client": "dist/cli.js"

13 },

14 "files": [

15 "dist/",

16 "scripts/postinstall.mjs",

17 "scripts/agentos-watchdog.sh"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "build": "node build.mjs --obfuscate",

22 "build:dev": "node build.mjs",

23 "publish-test": "node --check dist/cli.js && node --check dist/index.js && node --check dist/socket-server.js",

24 "prepublishOnly": "npm run build && npm run publish-test",

25 "release": "bash scripts/release.sh",

26 "release:dry": "bash scripts/release.sh --dry-run",

27 "release:patch": "bash scripts/release.sh patch",

28 "release:minor": "bash scripts/release.sh minor",

29 "release:np": "np",

30 "start": "node index.js",

31 "cli": "node cli.js",

32 "login": "node cli.js login",

33 "dev": "node cli.js"

34 },

35 "dependencies": {

36 "@agentclientprotocol/sdk": "^0.21.0",

37 "@langchain/core": "^1.1.0",

38 "@langchain/langgraph": "^1.2.8",

39 "@langchain/langgraph-checkpoint-sqlite": "^1.0.0",

40 "@langchain/mcp-adapters": "^1.1.3",

dist/socket-server.jsView file

1#!/usr/bin/env node L2: const _0x411ec0=_0x3543;(function(_0x2d25be,_0x7f20f7){const _0x1b4b36={_0x13a2b3:0x573,_0x1f31fe:0x1ca,_0x2570aa:0x11a,_0x1a3fe7:0x2ee,_0x4dcc2e:0x487,_0x2bf038:0x5a8},_0x561ae8=_...

High

Child Process

Package source references child process execution.

dist/socket-server.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L1

dist/index.jsView file

1#!/usr/bin/env node L2: const _0x6824d5=_0x4725;(function(_0x9bdfe1,_0x528aea){const _0x1cf95d={_0x2e1b1b:0x8e1,_0x489fca:0x160d,_0x4a617a:0x124b,_0x60d5c:0xef0,_0x457299:0x7fe,_0x3e5ac4:0xdea,_0x45a908:0...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: #!/usr/bin/env node L2: const _0x6824d5=_0x4725;(function(_0x9bdfe1,_0x528aea){const _0x1cf95d={_0x2e1b1b:0x8e1,_0x489fca:0x160d,_0x4a617a:0x124b,_0x60d5c:0xef0,_0x457299:0x7fe,_0x3e5ac4:0xdea,_0x45a908:0...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

scripts/postinstall.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * npm install -g xyt-agentos 后自动配置 PATH，并安装进程守护（幂等）。

4 */

5import { execSync } from 'child_process'

6import { appendFileSync, existsSync, readFileSync } from 'fs'

7import { homedir, platform } from 'os'

scripts/agentos-watchdog.shView file

•path = scripts/agentos-watchdog.sh kind = build_helper sizeBytes = 2366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agentos-watchdog.shView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/socket-server.jsView file

High

Child Process

Package source references child process execution.

dist/socket-server.jsView on unpkg · L1

Findings

9 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/socket-server.js

HighShell

HighSame File Env Network Executiondist/socket-server.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated Payload Loaderdist/socket-server.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighTrigger Reachable Persistencescripts/postinstall.mjs

HighObfuscated

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to xyt-agentos@1.1.6.

See all versions of xyt-agentos for other recorded verdicts.

Review the evidence and your use of xyt-agentos@1.1.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-20 23:17:20.741Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.