xyt-agentos@1.1.9
XYT AgentOS — Workent 龙虾桌面 Agent 客户端（xyt-client）
AI Security Review
scanned 29d ago · by lpm-firewall-aiThe install hook unconsentedly changes user PATH, installs crontab persistence through an obfuscated binary, and globally installs tokscale from a mirror, which is real install-hook risk. It does not show a hidden steal-and-send chain or a direct install-time rewrite of foreign agent config, so the package is a dangerous installer rather than confirmed malware.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install runs the postinstall script, and later xyt-client service or start commands run the obfuscated client.
Impact
A normal install can persist the client, change the user PATH, and pull another global package from registry.npmmirror.com. Runtime use can read or write other agents' skill directories and upload client telemetry to the vendor service.
Mechanism
postinstall appends PATH entries, launches powershell with ExecutionPolicy Bypass on Windows, executes xyt-client service install, and runs npm install -g tokscale. The bundled CLI contains a crontab update, and the bundles resolve .claude, .cursor, and .codex skill paths plus an api.minimaxi.com-style host and wss endpoint.
AI rationale
The install hook unconsentedly changes user PATH, installs crontab persistence through an obfuscated binary, and globally installs tokscale from a mirror, which is real install-hook risk. It does not show a hidden steal-and-send chain or a direct install-time rewrite of foreign agent config, so the package is a dangerous installer rather than confirmed malware.
Evidence
package.jsonscripts/postinstall.mjsdist/cli.jsdist/index.jsdist/socket-server.jsscripts/agentos-watchdog.sh~/.zshrc~/.bash_profile~/.profilecrontab.claude/skills.cursor/skills.codex
Network endpoints1
registry.npmmirror.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- npm install runs scripts/postinstall.mjs automatically.
- That hook appends a PATH export to the user .zshrc, .bash_profile, and .profile when those files exist.
- On Windows it writes the user Path variable through powershell with ExecutionPolicy Bypass.
- If the global xyt-client binary exists, postinstall runs service install, and the obfuscated CLI edits the user crontab to keep the client alive.
- Postinstall also runs npm install -g tokscale, first against registry.npmmirror.com.
- Obfuscated dist bundles resolve .claude, .cursor, and .codex skill directories and open a product websocket.
Evidence against
- The install script prints the PATH and watchdog changes instead of hiding them.
- Claude, Cursor, and Codex path handling sits in the runtime client, not in a direct postinstall write.
- Visible hosts are the product API fragments and the npm mirror, and the package does not depend on itself.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/xyt-client.jsView file
4*/
L5: import { spawn } from 'child_process'
L6: import { existsSync } from 'fs'
High
Findings
11 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/xyt-client.js
HighShellscripts/postinstall.mjs
HighSame File Env Network Executiondist/socket-server.js
HighCommand Output Exfiltrationdist/socket-server.js
HighObfuscated Payload Loaderdist/socket-server.js
HighCross File Remote Execution Contextbin/xyt-client.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencescripts/postinstall.mjs
HighRuntime Package Installscripts/postinstall.mjs
HighObfuscated
MediumAmbiguous Install Lifecycle Scriptpackage.json
Affected versions and remediation
This report applies to xyt-agentos@1.1.9.
See all versions of xyt-agentos for other recorded verdicts.
- Review the evidence and your use of xyt-agentos@1.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.