MalwarePublished 18 Jun 2026Updated 9 Jul 2026

@rafaelsene01/agent-flow (npm) · Malicious Code

Affects @rafaelsene01/agent-flowSource GCVE Database

Malicious package : remove @rafaelsene01/agent-flow and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6111

What to do

Remove @rafaelsene01/agent-flow from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@rafaelsene01/agent-flow	Affected 1.0.2 – 1.9.0 12 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec) The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator (declared as a devDependency in package.json). After deobfuscation, the runtime behavior matches the advertised purpose: a local Express server bound to 127.0.0.1:5522 that talks to api.github.com using the user-provided GH_TOKEN/GITHUB_TOKEN environment variable (or the local `gh auth token` output), manages git worktrees, and spawns the local `claude` CLI. No remote code fetch, no eval of remote content, no read of installer secret paths (~/.aws, ~/.ssh, ~/.netrc, ~/.npmrc), and no exfiltration destination beyond api.github.com. The postinstall hook only runs `npm install --prefix web` when `web/package.json` exists, which it does not in the published tarball. Obfuscating an MIT-licensed distributed bundle is a code-review-hostility concern rather than a supply-chain attack, but it materially raises the cost of independent verification and warrants human review. ## Source: ghsa-malware (a5df09db75f73bdebd523abf5b350fca006eafabadfeef16baccd7043191dc61) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the host, risking exposure of all stored secrets and keys. The malicious package may have installed additional undetected malware. Removal of the package alone does not guarantee eradication of all malicious components. Immediate secret and key rotation from a separate, trusted system is necessary to mitigate credential compromise.

Defensive guidance

Remove the @rafaelsene01/agent-flow package immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a different, secure machine. Because full system compromise is likely, conduct a thorough investigation and consider rebuilding affected hosts. Avoid installing or running this package in any environment.

Summary

The @rafaelsene01/agent-flow npm package versions including 1.0.2, 1.0.3, 1.0.4, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.7.0, and 1.9.0 contain malicious code. The main and binary entry point is a heavily obfuscated JavaScript bundle that runs a local Express server bound to 127.0.0.1:5522, which communicates with api.github.com using user-provided GitHub tokens or local authentication tokens. It manages git worktrees and spawns a local CLI tool named 'claude'. There is no evidence of remote code fetching, eval of remote content, or exfiltration beyond GitHub's API. The postinstall hook is inert in published versions. Despite the lack of remote exfiltration, the package is considered fully compromising any host where it is installed or executed, warranting immediate secret rotation and package removal. Obfuscation raises review difficulty but is not itself a supply-chain attack vector.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 09:55 UTC

Technical details

References

Community reviews