Malicious code in @guangnao/agent-proxy (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06) On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub.client-llm.com, reconstructed at runtime via XOR+base64 with key 'gnP2p!7xQ' from a base64 blob in dist/cli.js) and accepts remote `job` messages containing arbitrary path and body fields. These are POSTed into the local proxy and forwarded to api.anthropic.com and the Codex/ChatGPT upstream using the installer's on-disk OAuth credentials, with responses streamed back to the hub. An `onlyIfCredentialed` gate ensures only installers with valid Claude/Codex logins are enrolled as worker nodes serving requests originated by the hub operator. The behavior is undocumented; the README states the tool is 'self-use only' and warns that upstream vendor ToS forbid resale or sharing of accounts. The destination URL is not present as a plaintext string, only reconstructed at runtime, concealing it from casual review. The combination provides a remote-controlled command channel (arbitrary request path/body) into the installer's authenticated AI session and silently monetizes the installer's paid subscription for the hub operator's traffic.
AI Analysis
Technical Summary
The malicious code in @guangnao/agent-proxy (npm) versions =1.2.1, =1.4.0, and =1.4.2 activates on invocation of 'agent-proxy start'. It establishes an outbound WebSocket connection to an obfuscated endpoint (hub.client-llm.com), reconstructed at runtime to evade detection. Through this channel, the attacker can send remote 'job' messages containing arbitrary HTTP request paths and bodies, which the local proxy forwards to AI service endpoints (api.anthropic.com and Codex/ChatGPT) using the installer's OAuth credentials stored on disk. Responses are streamed back to the attacker's hub. An 'onlyIfCredentialed' gate ensures only users with valid AI service logins are exploited. This creates a remote-controlled command channel that silently monetizes the installer's paid AI subscription without their knowledge. The package's README warns against sharing accounts, but this malicious behavior is undocumented and concealed.
Potential Impact
Attackers gain unauthorized remote control over the installer's authenticated AI sessions, allowing them to send arbitrary requests through the installer's paid AI subscription accounts. This results in unauthorized use and monetization of the installer's subscription, potential data leakage through proxied requests, and violation of service terms. The installer's system is effectively turned into a worker node for the attacker's AI traffic without consent.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately discontinue use of the affected versions (=1.2.1, =1.4.0, =1.4.2) of @guangnao/agent-proxy. Review and remove the package from systems where it is installed. Monitor for any unauthorized outbound WebSocket connections to suspicious endpoints such as hub.client-llm.com. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in @guangnao/agent-proxy (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06) On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub.client-llm.com, reconstructed at runtime via XOR+base64 with key 'gnP2p!7xQ' from a base64 blob in dist/cli.js) and accepts remote `job` messages containing arbitrary path and body fields. These are POSTed into the local proxy and forwarded to api.anthropic.com and the Codex/ChatGPT upstream using the installer's on-disk OAuth credentials, with responses streamed back to the hub. An `onlyIfCredentialed` gate ensures only installers with valid Claude/Codex logins are enrolled as worker nodes serving requests originated by the hub operator. The behavior is undocumented; the README states the tool is 'self-use only' and warns that upstream vendor ToS forbid resale or sharing of accounts. The destination URL is not present as a plaintext string, only reconstructed at runtime, concealing it from casual review. The combination provides a remote-controlled command channel (arbitrary request path/body) into the installer's authenticated AI session and silently monetizes the installer's paid subscription for the hub operator's traffic.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The malicious code in @guangnao/agent-proxy (npm) versions =1.2.1, =1.4.0, and =1.4.2 activates on invocation of 'agent-proxy start'. It establishes an outbound WebSocket connection to an obfuscated endpoint (hub.client-llm.com), reconstructed at runtime to evade detection. Through this channel, the attacker can send remote 'job' messages containing arbitrary HTTP request paths and bodies, which the local proxy forwards to AI service endpoints (api.anthropic.com and Codex/ChatGPT) using the installer's OAuth credentials stored on disk. Responses are streamed back to the attacker's hub. An 'onlyIfCredentialed' gate ensures only users with valid AI service logins are exploited. This creates a remote-controlled command channel that silently monetizes the installer's paid AI subscription without their knowledge. The package's README warns against sharing accounts, but this malicious behavior is undocumented and concealed.
Potential Impact
Attackers gain unauthorized remote control over the installer's authenticated AI sessions, allowing them to send arbitrary requests through the installer's paid AI subscription accounts. This results in unauthorized use and monetization of the installer's subscription, potential data leakage through proxied requests, and violation of service terms. The installer's system is effectively turned into a worker node for the attacker's AI traffic without consent.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately discontinue use of the affected versions (=1.2.1, =1.4.0, =1.4.2) of @guangnao/agent-proxy. Review and remove the package from systems where it is installed. Monitor for any unauthorized outbound WebSocket connections to suspicious endpoints such as hub.client-llm.com. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14047
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7ff5f6bf8831d539880065
Added to database: 08/15/2026, 05:15:34 UTC
Last enriched: 08/15/2026, 05:42:39 UTC
Last updated: 09/29/2026, 22:28:08 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.