registry / Data exfiltration / xyt-desktop-client

xyt-desktop-client

XYT Agent Desktop Client

This report shows the evidence for xyt-desktop-client@1.0.3, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The source establishes automatic collection and upload of sensitive third-party agent data, not merely a user-requested upload feature. Absence of an install hook does not mitigate the runtime exfiltration behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Run the client and establish a connected desktop session.

Impact

Disclosure of private prompts, conversations, project metadata, and agent state.

Mechanism

periodic cross-agent transcript and database collection with multipart upload

Attack narrative

At runtime, the client starts a dialogue-upload timer after connection. It discovers Claude Code, Codex, OpenClaw, Hermes, and Cursor data, packages histories/projects/databases (including Cursor transcripts and state), and sends them to workentai.com's dialogue-upload endpoint. This is a concrete, recurring data-exfiltration chain targeting unrelated local AI-agent control data.

AI rationale

Evidence

package.jsondist/index.js~/.claude~/.codex~/.openclaw~/.cursor

Network endpoints1

www.workentai.com/api/copywriting/scene/dialogue/upload

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/index.js: startDialogueUploadTimer immediately scans and periodically uploads dialogue data after connection.
dist/index.js: uploadClaudeDialogues/uploadCodexDialogues/uploadOpenClawDialogues/uploadCursorProjects collect third-party agent histories, projects, databases, and transcripts.
dist/index.js: tM/H0e POST collected ZIPs/databases to /copywriting/scene/dialogue/upload on workentai.com.
dist/index.js: Cursor collection copies state.vscdb, agent transcripts, and store.db before upload.

Evidence against

package.json has only prepublishOnly; no install-time hook.
The login endpoint is user-invoked, but background collection begins once the client is connected.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 4 file(s), 771 KB of source, external domains: api.deepseek.com, api.minimaxi.com, api.smith.langchain.com, claude.ai, cursor.sh, docs.langchain.com, github.com, json-schema.org, marked.js.org, open.bigmodel.cn, openclaw.app, plus-innovations.com, systeminformation.io, www.buymeacoffee.com, www.npmjs.com, www.workent.ai, www.workentai.com

Oversized source lightweight scan

dist/cli.js2.96 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsProtestwareapi.smith.langchain.comdocs.langchain.commarked.js.orgwww.npmjs.comwww.workentai.com

dist/index.js3.52 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsCryptoHighEntropyStringsMinifiedUrlStringsclaude.aicursor.shgithub.comopenclaw.appplus-innovations.comsysteminformation.iowww.buymeacoffee.comwww.workent.aiwww.workentai.com

dist/socket-server.js2.99 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsProtestwareapi.deepseek.comapi.minimaxi.comjson-schema.orgopen.bigmodel.cnwww.workentai.com

Source & flagged code

12 flagged

dist/socket-server.jsView file

2import{createRequire}from'node:module';var require=createRequire(import.meta.url); L3: var fet=Object.create;var $B=Object.defineProperty;var pet=Object.getOwnPropertyDescriptor;var het=Object.getOwnPropertyNames;var met=Object.getPrototypeOf,get=Object.prototype.has... L4: `).join(`\r ... L8: \r L9: `+r)}function $g(e,t,r,n,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,$g),e.emit("wsClientError",o,r,t)}else ak(r,n,i,s)}});var ipe={};Mn(... L10: `);let n;for(;(n=art.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let o=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),o==='"'&&(s=s.replace(/\\n/g,` L11: `),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function lrt(e){e=e||{};let t=ppe(e);e.path=t;let r=Zi.configDotenv(e);if(!r.parsed){let o=new Erro

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/socket-server.jsView on unpkg · L2

High

Child Process

Package source references child process execution.

dist/socket-server.jsView on unpkg · L8

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/socket-server.jsView on unpkg · L2

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/socket-server.jsView on unpkg · L2

88`+B);let[,ae]=K;return ae.replace(/\s/g,"").split(et).map(ce=>ce.replace(ot,"").trim())}function Ar(G,B){var K={};return Object.keys(G).forEach(ae=>{var ce=G[ae],ve,we=h(ce),Ce=!we... L89: GFS4: `),console.error(e)});ri[Rs]||(uve=global[Rs]||[],fve(ri,uve),ri.close=(function(e){function t(r,n){return e.call(ri,r,function(i){i||dve(),typeof n=="function"&&n.apply(this... L90: %s`,C,C,x,n);var D=x.type==="*"?J8:x.type==="?"?K8:"\\"+x.type;i=!0,n=n.slice(0,x.reStart)+D+"\\("+C}m(),s&&(n+="\\\\");var R=!1;switch(n.charAt(0)){case"[":case".":case"(":R=!0}fo...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L88

8\r L9: `+r)}function $g(e,t,r,n,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,$g),e.emit("wsClientError",o,r,t)}else ak(r,n,i,s)}});var ipe={};Mn(... L10: `);let n;for(;(n=art.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let o=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),o==='"'&&(s=s.replace(/\\n/g,` L11: `),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function lrt(e){e=e||{};let t=ppe(e);e.path=t;let r=Zi.configDotenv(e);if(!r.parsed){let o=new Error(`MISSING_DATA: Cannot parse ${t} f... L12: `)}var bpe,yk,da,k6=S(()=>{Dg();_t();bpe=(e,t)=>{e.name="$ZodError",Object.defineProperty(e,"_zod",{value:e._zod,enumerable:!1}),Object.defineProperty(e,"issues",{value:t,enumerabl... ... L2150: L2151: ## Available Tools L2152:

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/socket-server.jsView on unpkg · L8

2Cross-file remote execution chain: dist/socket-server.js spawns dist/index.js; helper contains network access plus dynamic code execution. L2: import{createRequire}from'node:module';var require=createRequire(import.meta.url); L3: var fet=Object.create;var $B=Object.defineProperty;var pet=Object.getOwnPropertyDescriptor;var het=Object.getOwnPropertyNames;var met=Object.getPrototypeOf,get=Object.prototype.has... L4: `).join(`\r ... L8: \r L9: `+r)}function $g(e,t,r,n,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,$g),e.emit("wsClientError",o,r,t)}else ak(r,n,i,s)}});var ipe={};Mn(... L10: `);let n;for(;(n=art.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let o=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),o==='"'&&(s=s.replace(/\\n/g,` L11: `),s=

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/socket-server.jsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/socket-server.jsView on unpkg · L2

dist/index.jsView file

2Trigger-reachable chain: manifest.main -> dist/index.js L2: import{createRequire}from'node:module';var require=createRequire(import.meta.url); L3: var Wft=Object.create;var v9=Object.defineProperty;var Gft=Object.getOwnPropertyDescriptor;var Kft=Object.getOwnPropertyNames;var Zft=Object.getPrototypeOf,Jft=Object.prototype.has... L4: `).join(`\r ... L8: \r L9: `+r)}function y_(e,t,r,n,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,y_),e.emit("wsClientError",o,r,t)}else z1(r,n,i,s)}});var Dve={};ui(... L10: `)[0].split(":");Ku=r.length>1?r[1].replace(".","").trim():""}catch{Ku="437"}return Ku}if(J9||Uve||Bve||qve||Hve){if(!Ku)try{let r=B1("echo $LANG",ZM).toString().split(`\r

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L2

2import{createRequire}from'node:module';var require=createRequire(import.meta.url); L3: var Wft=Object.create;var v9=Object.defineProperty;var Gft=Object.getOwnPropertyDescriptor;var Kft=Object.getOwnPropertyNames;var Zft=Object.getPrototypeOf,Jft=Object.prototype.has... L4: `).join(`\r ... L8: \r L9: `+r)}function y_(e,t,r,n,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,y_),e.emit("wsClientError",o,r,t)}else z1(r,n,i,s)}});var Dve={};ui(... L10: `)[0].split(":");Ku=r.length>1?r[1].replace(".","").trim():""}catch{Ku="437"}return Ku}if(J9||Uve||Bve||qve||Hve){if(!Ku)try{let r=B1("echo $LANG",ZM).toString().split(`\r ... L19: `).filter(n=>n.includes(t)).join(` L20: `)}function uht(){}Vt.toInt=wpt;Vt.splitByNumber=Spt;Vt.execOptsWin=KM;Vt.execOptsLi

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L2

Source & flagged code

12 flagged · loading source

dist/socket-server.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/socket-server.jsView on unpkg · L2

High

Child Process

Package source references child process execution.

dist/socket-server.jsView on unpkg · L8

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/socket-server.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/socket-server.jsView on unpkg · L2

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/socket-server.jsView on unpkg · L2

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/socket-server.jsView on unpkg · L88

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/socket-server.jsView on unpkg · L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/socket-server.jsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/socket-server.jsView on unpkg · L2

dist/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L2

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L2

2Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L2: import{createRequire}from'node:module';var require=createRequire(import.meta.url); L3: var Wft=Object.create;var v9=Object.defineProperty;var Gft=Object.getOwnPropertyDescriptor;var Kft=Object.getOwnPropertyNames;var Zft=Object.getPrototypeOf,Jft=Object.prototype.has... L4: `).join(`\r ... L8: \r L9: `+r)}function y_(e,t,r,n,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,y_),e.emit("wsClientError",o,r,t)}else z1(r,n,i,s)}});var Dve={};ui(... L10: `)[0].split(":");Ku=r.length>1?r[1].replace(".","").trim():""}catch{Ku="437"}return Ku}if(J9||Uve||Bve||qve||Hve){if(!Ku)try{let r=B1("echo $LANG",ZM).toString().split(`\r

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L2

Findings

2 Critical10 High4 Medium8 Low

CriticalRemote Asset Decode Executedist/socket-server.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/socket-server.js

HighShell

HighSame File Env Network Executiondist/socket-server.js

HighCommand Output Exfiltrationdist/socket-server.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCloud Metadata Accessdist/socket-server.js

HighObfuscated Payload Loaderdist/socket-server.js

HighRemote Agent Bridgedist/socket-server.js

HighCross File Remote Execution Contextdist/socket-server.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/socket-server.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to xyt-desktop-client@1.0.3.

The versions list below shows the verdict for each recorded version.

Avoid installing xyt-desktop-client@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 18:51:50.741Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.3latestshownMaliciousData ExfiltrationBlockPublishedAug 5, 2026, 2:36 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Related packages

Other data exfiltration packages

Source & flagged code