MalwarePublished 16 Jul 2026Updated 6 Aug 2026

vanexa-agent (npm) · Malicious Code

Affects vanexa-agentSource GCVE Database

Malicious package : remove vanexa-agent and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 07:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10751

What to do

Remove vanexa-agent from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvanexa-agent	Affected 1.1.8 – 1.1.48 30 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The vanexa-agent npm package contains malicious code that establishes a persistent WebSocket connection to a hardcoded external relay controlled by an attacker. This connection allows the attacker to send commands that the agent executes on the host system with shell access, enabling arbitrary command execution. The authentication mechanism relies solely on a user-typed 6-digit code with no cryptographic protections, making it vulnerable to guessing or interception. Sensitive information, including the hostname and encrypted API keys, is transmitted to the relay. This vulnerability affects multiple specific versions of vanexa-agent and poses a critical risk of remote code execution.

Impact

An attacker controlling the relay server or guessing the 6-digit session code can execute arbitrary shell commands on any host running the vulnerable vanexa-agent versions. This leads to full remote code execution, potential data exfiltration, system compromise, and lateral movement within affected environments. Sensitive configuration and encrypted API keys are also exposed to the attacker. The vulnerability effectively creates a backdoor with minimal authentication and no cryptographic protections.

Defensive guidance

Users should immediately stop running the vanexa-agent daemon and remove the package from their systems. Avoid connecting to the hardcoded relay URL and do not use the package until a vendor advisory or update is available. Monitor for any unauthorized activity on affected hosts.

Summary

The vanexa-agent package, when started, opens a persistent WebSocket connection to a hardcoded Cloudflare Workers relay URL. It processes incoming 'task_request' messages by executing shell commands on the host via spawn('/bin/bash', ['-c', command]) or equivalent on Windows. The only authentication is a 6-digit pairing code used as a session ID, with no JWT or message signing, allowing anyone controlling the relay or guessing the code to execute arbitrary commands. Configuration updates and sensitive data, including encrypted API keys and hostname, are sent to the relay. The package's README misleadingly advertises LAN-only communication, but the code forces WAN relay usage. This design constitutes a malicious backdoor enabling remote code execution on affected hosts.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 07:43 UTC

Technical details

References

Community reviews