Loading npm security reports…

xyt-agentos@1.1.7: Malicious npm security report (Block) | LPM Firewall

registry / xyt-agentos / 1.1.7

xyt-agentos@1.1.7

XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installation mutates interactive shell profiles and attempts to install an always-on service guard. The bundled watchdog restarts the client when it stops.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall, especially global installation where xyt-client is available

Impact

Changes user startup configuration and establishes recurring execution of the package client.

Mechanism

unconsented shell-profile modification and service persistence

Attack narrative

The package executes a postinstall hook that appends its PATH entry to shell startup files. When the global binary is present, it silently runs its service-install command and states that it configures launchd or cron. Its supplied watchdog then restarts the client when its log or PID check indicates it is absent, creating unconsented persistence from installation.

Rationale

Source inspection confirms install-time mutation of user shell configuration and automatic persistence, not merely static hints. This is concrete unconsented behavior with system-wide startup impact.

Evidence

package.jsonscripts/postinstall.mjsscripts/agentos-watchdog.sh.zshrc.bash_profile.profile.xyt-agent/logs/xyt-client.log.xyt-agent/xyt-client.pid

Decision evidence

public snapshot

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/socket-server.jsView file

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

High

Child Process

Package source references child process execution.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/socket-server.jsView on unpkg · L1

scripts/postinstall.mjsView file

4Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.mjs L4: */ L5: import { execSync } from 'child_process' L6: import { appendFileSync, existsSync, readFileSync } from 'fs' ... L17: } catch { L18: return join(homedir(), '.npm-global', 'bin') L19: } ... L25: const profiles = [ L26: join(homedir(), '.zshrc'), L27: join(homedir(), '.bash_profile'), ... L56: stdio: 'pipe', L57: env: { ...process.env, PATH: `${binDir}:${process.env.PATH || ''}` }, L58: })

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.mjsView on unpkg · L4

4*/ L5: import { execSync } from 'child_process' L6: import { appendFileSync, existsSync, readFileSync } from 'fs' ... L17: } catch { L18: return join(homedir(), '.npm-global', 'bin') L19: } ... L25: const profiles = [ L26: join(homedir(), '.zshrc'), L27: join(homedir(), '.bash_profile'), ... L56: stdio: 'pipe', L57: env: { ...process.env, PATH: `${binDir}:${process.env.PATH || ''}` }, L58: })

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/postinstall.mjsView on unpkg · L4

scripts/agentos-watchdog.shView file

•path = scripts/agentos-watchdog.sh kind = build_helper sizeBytes = 2366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agentos-watchdog.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = xyt-agentos@1.1.6 matchedIdentity = npm:eHl0LWFnZW50b3M:1.1.6 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "xyt-agentos",

3 "version": "1.1.7",

4 "description": "XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）",

5 "type": "module",

6 "main": "dist/index.js",

7 "exports": {

8 ".": "./dist/index.js",

9 "./sdk": "./dist/socket-server.js"

10 },

11 "bin": {

12 "xyt-client": "dist/cli.js"

13 },

14 "files": [

15 "dist/",

16 "scripts/postinstall.mjs",

17 "scripts/agentos-watchdog.sh"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "build": "node build.mjs --obfuscate",

22 "build:dev": "node build.mjs",

23 "publish-test": "node --check dist/cli.js && node --check dist/index.js && node --check dist/socket-server.js",

24 "prepublishOnly": "npm run build && npm run publish-test",

25 "release": "bash scripts/release.sh",

26 "release:dry": "bash scripts/release.sh --dry-run",

27 "release:patch": "bash scripts/release.sh patch",

28 "release:minor": "bash scripts/release.sh minor",

29 "release:np": "np",

30 "start": "node index.js",

31 "cli": "node cli.js",

32 "login": "node cli.js login",

33 "dev": "node cli.js"

34 },

35 "dependencies": {

36 "@agentclientprotocol/sdk": "^0.21.0",

37 "@langchain/core": "^1.1.0",

38 "@langchain/langgraph": "^1.2.8",

39 "@langchain/langgraph-checkpoint-sqlite": "^1.0.0",

40 "@langchain/mcp-adapters": "^1.1.3",

dist/socket-server.jsView file

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

High

Child Process

Package source references child process execution.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L1

1#!/usr/bin/env node L2: const _0x5bb523=_0x42a1;(function(_0x79b27d,_0x1aa556){const _0x5d58c4={_0x4e461b:0x94b,_0x114ea5:0x76f,_0x4e7457:0x3ed},_0x2b0d24=_0x42a1,_0xbcf135=_0x79b27d();while(!![]){try{con...

scripts/postinstall.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * npm install -g xyt-agentos 后自动配置 PATH，并安装进程守护（幂等）。

4 */

5import { execSync } from 'child_process'

6import { appendFileSync, existsSync, readFileSync } from 'fs'

7import { homedir, platform } from 'os'

scripts/agentos-watchdog.shView file

•path = scripts/agentos-watchdog.sh kind = build_helper sizeBytes = 2366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agentos-watchdog.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = xyt-agentos@1.1.6 matchedIdentity = npm:eHl0LWFnZW50b3M:1.1.6 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg