Malicious code in @vanexalabs-ai/vanexa-agent (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c) The package implements a daemon that pairs with a remote peer (phone) over WebRTC, using https://vanexa-agent-relay.workers.dev and https://vanexa-agent-relay.tubefood.workers.dev as signaling relays, and executes commands received over the DataChannel by dispatching them into child_process.spawn/exec on the host running the agent. onData/onCommand/onmessage handlers are wired to shell/exec sinks in dist/bundle.cjs (POST calls at lines 221, 285, 426, 1953, 2101 correspond to signaling traffic). Anyone who controls the signaling relay or a paired peer obtains full-host remote code execution on the machine running the agent. The runtime dispatch logic is shipped only as V8 bytecode (dist/bundle.jsc loaded via bytenode from bin/vanexa-agent.js), with the.cjs fallback minified, framed in the README as 'commercial IP protection' — pairing/authorization semantics are not reviewable from source. A socket.json at the tarball root sets 'ignore' for aiMalware, gptMalware, obfuscatedCode, usesEval, nativeCode, shellAccess, filesystemAccess, networkAccess, bypassesEnvironment, and installScripts — a blanket suppression matching exactly the categories this package's runtime behavior triggers. The shell surface fires when the operator explicitly runs the agent (not at npm install or on require), so blast radius is bounded to hosts where an operator starts the daemon and completes pairing; however, once running, the remote peer channel is the attack surface.
AI Analysis
Technical Summary
The @vanexalabs-ai/vanexa-agent package implements a daemon that pairs with a remote peer (such as a phone) over WebRTC using specific signaling relays. Commands received over the DataChannel are executed on the host via child_process.spawn/exec, allowing full remote code execution by anyone controlling the signaling relay or paired peer. The runtime dispatch logic is shipped as V8 bytecode, preventing review of pairing and authorization semantics. The package suppresses detection by ignoring categories related to malware, obfuscation, shell access, and network access. The malicious shell execution activates only when the operator explicitly runs the agent and completes pairing, bounding the attack surface to those hosts.
Potential Impact
An attacker controlling the signaling relay or a paired remote peer can achieve full remote code execution on the host running the agent. This allows arbitrary command execution with the privileges of the agent process, potentially leading to full system compromise on affected hosts where the agent is actively running and paired.
Mitigation Recommendations
No official patch or remediation is currently documented. Operators should avoid running the @vanexalabs-ai/vanexa-agent daemon to prevent exposure. Since the malicious behavior activates only when the agent is explicitly started and paired, not at install or require time, avoiding execution of the daemon effectively mitigates risk. Monitor for and remove this package from environments where it is not explicitly required or trusted. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Malicious code in @vanexalabs-ai/vanexa-agent (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c) The package implements a daemon that pairs with a remote peer (phone) over WebRTC, using https://vanexa-agent-relay.workers.dev and https://vanexa-agent-relay.tubefood.workers.dev as signaling relays, and executes commands received over the DataChannel by dispatching them into child_process.spawn/exec on the host running the agent. onData/onCommand/onmessage handlers are wired to shell/exec sinks in dist/bundle.cjs (POST calls at lines 221, 285, 426, 1953, 2101 correspond to signaling traffic). Anyone who controls the signaling relay or a paired peer obtains full-host remote code execution on the machine running the agent. The runtime dispatch logic is shipped only as V8 bytecode (dist/bundle.jsc loaded via bytenode from bin/vanexa-agent.js), with the.cjs fallback minified, framed in the README as 'commercial IP protection' — pairing/authorization semantics are not reviewable from source. A socket.json at the tarball root sets 'ignore' for aiMalware, gptMalware, obfuscatedCode, usesEval, nativeCode, shellAccess, filesystemAccess, networkAccess, bypassesEnvironment, and installScripts — a blanket suppression matching exactly the categories this package's runtime behavior triggers. The shell surface fires when the operator explicitly runs the agent (not at npm install or on require), so blast radius is bounded to hosts where an operator starts the daemon and completes pairing; however, once running, the remote peer channel is the attack surface.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @vanexalabs-ai/vanexa-agent package implements a daemon that pairs with a remote peer (such as a phone) over WebRTC using specific signaling relays. Commands received over the DataChannel are executed on the host via child_process.spawn/exec, allowing full remote code execution by anyone controlling the signaling relay or paired peer. The runtime dispatch logic is shipped as V8 bytecode, preventing review of pairing and authorization semantics. The package suppresses detection by ignoring categories related to malware, obfuscation, shell access, and network access. The malicious shell execution activates only when the operator explicitly runs the agent and completes pairing, bounding the attack surface to those hosts.
Potential Impact
An attacker controlling the signaling relay or a paired remote peer can achieve full remote code execution on the host running the agent. This allows arbitrary command execution with the privileges of the agent process, potentially leading to full system compromise on affected hosts where the agent is actively running and paired.
Mitigation Recommendations
No official patch or remediation is currently documented. Operators should avoid running the @vanexalabs-ai/vanexa-agent daemon to prevent exposure. Since the malicious behavior activates only when the agent is explicitly started and paired, not at install or require time, avoiding execution of the daemon effectively mitigates risk. Monitor for and remove this package from environments where it is not explicitly required or trusted. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13397
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a74cf8ebf8831d5391aeaa1
Added to database: 08/06/2026, 18:16:46 UTC
Last enriched: 08/06/2026, 18:41:48 UTC
Last updated: 09/18/2026, 02:12:34 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.