@ikbal_fadilah_vanexa01/vanexa-agent

{"schema_version":"1.7.4","id":"MAL-2026-13364","published":"2026-08-05T18:16:17Z","modified":"2026-08-06T14:21:50.845518796Z","summary":"Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (52b1477c5187703dab87d6be6933d62de4c4244ab3340586f85b530e05470aa1)\nPackage ships an agent daemon (`vanexa-agent start`, entry `bin/vanexa-agent.js`) that receives commands from a remote phone app and executes them on the installer's host via `child_process`/`spawn`, including `powershell.exe` and inline JS/Python evaluation. Rather than the LAN-only WebSocket architecture described in the README (which claims BYOK with `no middleman`), the compiled bundle hardcodes two Cloudflare Workers endpoints — `vanexa-agent-relay.hanazaki542.workers.dev` and `vanexa-ai-proxy.hanazaki542.workers.dev` — hosted on a personal Cloudflare account (`hanazaki542`) that does not match the npm publisher (`ikbalsakata500445jensen`). Commands from the phone client and, via the AI proxy path, user-supplied prompt content and API tokens transit this third-party intermediary before reaching the local execution sinks on the installer's machine. The primary runtime is shipped as V8 bytecode (`dist/bundle.jsc`) produced from `dist/bundle.cjs` at postinstall via `bytenode.compileFile`, and the bin entry loads that bytecode with `require(bytecodePath)`, reducing auditability of the network-driven exec path. The combination — network-sourced commands flowing into local shell/child_process, a hardcoded author-controlled relay whose ownership does not match the publisher, and a bytecode-compiled payload — makes normal operator use of this agent equivalent to granting the relay operator remote command execution on the installer's host.\n","affected":[{"package":{"name":"@ikbal_fadilah_vanexa01/vanexa-agent","ecosystem":"npm"},"versions":["1.3.10","1.3.19","1.3.23","1.1.53","1.3.17","1.3.8","1.1.54","1.2.0","1.1.55","1.3.34","1.3.3","1.1.58","1.1.59","1.3.14","1.3.32","1.3.44","1.3.9","1.3.40","1.3.29","1.3.15","1.3.31","1.1.56","1.1.57","1.3.27","1.3.35","1.3.6","1.3.45","1.3.12","1.1.52","1.3.21","1.1.51","1.3.4","1.3.7","1.3.28","1.3.37"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/bundle.cjs","sha256":"d65ded4a78096774ff3a08dfe8e994e46dd078fa933f541063aacef92218ebf2","tlsh":"ac955c6d73a6766123e760e4cc36010ae16999581809d539f3fcf8e7bb52888c1e7f78"}],"package_integrity":[{"filename":"vanexa-agent-1.3.10.tgz","hashes":{"sha1":"663b134e9d4d02f32154f19fb0b339e8422becda","sha512_sri":"sha512-KitccSWWSe6IeiMRGwFUwMzP59SlWWIg367nOE8gD13g0lf1d70IEHR3s5VJ1v2pg8UxWJkq8OZuYrlEJ5WMUg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.23"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.53"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.54"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.55"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.34"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.58"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.59"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.32"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.44"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.40"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.29"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.31"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.56"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.57"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.27"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.35"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.45"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.52"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.1.51"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ikbal_fadilah_vanexa01/vanexa-agent/v/1.3.37"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015847","import_time":"2026-08-05T19:04:54.214569101Z","modified_time":"2026-08-05T18:16:17Z","sha256":"481daae8905848ad63e1ea0680645761de3594c5eaa017e9e6f6ea8fe6e2282e","source":"amazon-inspector","versions":["1.3.10"]},{"id":"IN-MAL-2026-016556","import_time":"2026-08-06T14:19:55.287823593Z","modified_time":"2026-08-06T14:12:48Z","sha256":"d9f41ee3ef2d3e711f00b2d2f5df471d2c2c1f4e7be9b4563017526c23bd14b3","source":"amazon-inspector","versions":["1.3.19"]},{"id":"IN-MAL-2026-016582","import_time":"2026-08-06T14:19:56.185108049Z","modified_time":"2026-08-06T14:16:39Z","sha256":"1694969f49b4c30e299fc9b51dd60e8e24faa97c853c663b5fad018cf6ed7163","source":"amazon-inspector","versions":["1.3.23"]},{"id":"IN-MAL-2026-016587","import_time":"2026-08-06T14:19:56.341893951Z","modified_time":"2026-08-06T14:17:23Z","sha256":"57c73c2e900eee675453cbc41cad5992640f1f9051bd49ea789b16a13328e8d4","source":"amazon-inspector","versions":["1.1.53"]},{"id":"IN-MAL-2026-016557","import_time":"2026-08-06T14:19:55.315355765Z","modified_time":"2026-08-06T14:12:58Z","sha256":"60838012b6a1c5baf88d9034d495dcfad4b4b4bed2eca7740214896931823e6d","source":"amazon-inspector","versions":["1.3.17"]},{"id":"IN-MAL-2026-016579","import_time":"2026-08-06T14:19:55.957209714Z","modified_time":"2026-08-06T14:16:08Z","sha256":"f01d8891e773a84f7171ba737ee556bc7116dccd30c73f090dc24f24143ad82f","source":"amazon-inspector","versions":["1.3.8"]},{"id":"IN-MAL-2026-016574","import_time":"2026-08-06T14:19:55.813666372Z","modified_time":"2026-08-06T14:15:24Z","sha256":"ffd15f555cf1d4e138b64b2ede6dbdacacde6cbd4412f3791a3a54f25b81d655","source":"amazon-inspector","versions":["1.1.54"]},{"id":"IN-MAL-2026-016558","import_time":"2026-08-06T14:19:55.338612074Z","modified_time":"2026-08-06T14:13:07Z","sha256":"0fe7fb20ec36246992d1b4faaa2b1e5afae4e37cda843fc6ae7848dfc2b3f8f2","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-016571","import_time":"2026-08-06T14:19:55.719577915Z","modified_time":"2026-08-06T14:14:58Z","sha256":"78ba42c806346cb3d718d37a576e5237be553c0c00dfe9c27f224fb96962b4f9","source":"amazon-inspector","versions":["1.1.55"]},{"id":"IN-MAL-2026-016565","import_time":"2026-08-06T14:19:55.532014166Z","modified_time":"2026-08-06T14:14:07Z","sha256":"92597f62bf4b6df199a7784aa71dfbf9b9e40b59f9580bec8e782e6312940428","source":"amazon-inspector","versions":["1.3.34"]},{"id":"IN-MAL-2026-016586","import_time":"2026-08-06T14:19:56.308677854Z","modified_time":"2026-08-06T14:17:13Z","sha256":"9a7cf61c610e5a38f9efbba3a984886acd7d6e933e95bbbeffc526b9592f3ee3","source":"amazon-inspector","versions":["1.3.3"]},{"id":"IN-MAL-2026-016576","import_time":"2026-08-06T14:19:55.872579523Z","modified_time":"2026-08-06T14:15:41Z","sha256":"aaf0c2e39ba69473adfb41e866f8faeb413c8ca83136bae9a78710192d7aa8fd","source":"amazon-inspector","versions":["1.1.58"]},{"id":"IN-MAL-2026-016575","import_time":"2026-08-06T14:19:55.84274063Z","modified_time":"2026-08-06T14:15:34Z","sha256":"ad5455301be007ba880e5dc2a4e7912fa761ca2d2fd83f027d6560a3b6a93e7c","source":"amazon-inspector","versions":["1.1.59"]},{"id":"IN-MAL-2026-016560","import_time":"2026-08-06T14:19:55.392726854Z","modified_time":"2026-08-06T14:13:23Z","sha256":"aead634b0fe8b0dd2adf56d74a20306c7a53def0da70ba15fdce13785fea8af6","source":"amazon-inspector","versions":["1.3.14"]},{"id":"IN-MAL-2026-016572","import_time":"2026-08-06T14:19:55.750823325Z","modified_time":"2026-08-06T14:15:09Z","sha256":"b8174bacba0ef373f43333e2ede4dfe730ed4d8675f32766f1a97de25f9e3566","source":"amazon-inspector","versions":["1.3.32"]},{"id":"IN-MAL-2026-016589","import_time":"2026-08-06T14:19:56.40186931Z","modified_time":"2026-08-06T14:17:42Z","sha256":"daeb89ff38231ef6701b4402aab97c44d5709148a8be71f0751458e0393f7964","source":"amazon-inspector","versions":["1.3.44"]},{"id":"IN-MAL-2026-016588","import_time":"2026-08-06T14:19:56.369362333Z","modified_time":"2026-08-06T14:17:30Z","sha256":"356fd03c2bd7c9bafd3a3d1f4e21f2b982f364c1f9035440802108ab6fcac764","source":"amazon-inspector","versions":["1.3.9"]},{"id":"IN-MAL-2026-016566","import_time":"2026-08-06T14:19:55.558405417Z","modified_time":"2026-08-06T14:14:15Z","sha256":"5879d9167255b615df85872c600553d5b2c83b99420ff34806c393bceaa86661","source":"amazon-inspector","versions":["1.3.40"]},{"id":"IN-MAL-2026-016563","import_time":"2026-08-06T14:19:55.478945933Z","modified_time":"2026-08-06T14:13:49Z","sha256":"cd6e2b04b9a1b32cde1e1f7f9b06ed1b553c02a4791489f849acac8080285a23","source":"amazon-inspector","versions":["1.3.29"]},{"id":"IN-MAL-2026-016559","import_time":"2026-08-06T14:19:55.367687329Z","modified_time":"2026-08-06T14:13:15Z","sha256":"ceef7861c370625085d1a0725922c8a184265a335c31095529a8dd58f04c58f7","source":"amazon-inspector","versions":["1.3.15"]},{"id":"IN-MAL-2026-016564","import_time":"2026-08-06T14:19:55.504390632Z","modified_time":"2026-08-06T14:13:58Z","sha256":"049497a6b0aafd1f65a52984e227c333c0809946fa5cd4c899062e442fd5fdfb","source":"amazon-inspector","versions":["1.3.31"]},{"id":"IN-MAL-2026-016570","import_time":"2026-08-06T14:19:55.690192475Z","modified_time":"2026-08-06T14:14:51Z","sha256":"10b28cb6809fceca186b78441fa1469c355bc4d2cba5ec5a826bf91df5b1a6b8","source":"amazon-inspector","versions":["1.1.56"]},{"id":"IN-MAL-2026-016573","import_time":"2026-08-06T14:19:55.781052083Z","modified_time":"2026-08-06T14:15:17Z","sha256":"cdb7a39c047dcbc3b1bea5beb43d9b6bcabc631e604ba0cbf903e95ed17c4016","source":"amazon-inspector","versions":["1.1.57"]},{"id":"IN-MAL-2026-016562","import_time":"2026-08-06T14:19:55.446145559Z","modified_time":"2026-08-06T14:13:41Z","sha256":"ef6d2ea845e3d127d15ee799d878dee6655365eacb5dc306f564d59a891ebdf9","source":"amazon-inspector","versions":["1.3.27"]},{"id":"IN-MAL-2026-016585","import_time":"2026-08-06T14:19:56.279451118Z","modified_time":"2026-08-06T14:17:06Z","sha256":"367330aab67ac352c10ddb6e142dade22d8111ce38bd1522270a54f34dcd05f2","source":"amazon-inspector","versions":["1.3.35"]},{"id":"IN-MAL-2026-016568","import_time":"2026-08-06T14:19:55.635724898Z","modified_time":"2026-08-06T14:14:30Z","sha256":"5037e0458321aa0485797aca70eecf5781d98d547e0b7ab736e0a13169a20509","source":"amazon-inspector","versions":["1.3.6"]},{"id":"IN-MAL-2026-016567","import_time":"2026-08-06T14:19:55.606110252Z","modified_time":"2026-08-06T14:14:22Z","sha256":"7f717cd4c6b774f55fe369a298f16814c3cdf0c0e34733c54fa373319a81080f","source":"amazon-inspector","versions":["1.3.45"]},{"id":"IN-MAL-2026-016580","import_time":"2026-08-06T14:19:55.988650418Z","modified_time":"2026-08-06T14:16:20Z","sha256":"8539ccd87d3b47388e734dcca16f8cb2569eccddc83d3f6a7eda3c08b3dc9a8b","source":"amazon-inspector","versions":["1.3.12"]},{"id":"IN-MAL-2026-016577","import_time":"2026-08-06T14:19:55.899546475Z","modified_time":"2026-08-06T14:15:51Z","sha256":"f1e2e6e78b5768af12f029dd2151f4a833905cb9aefa8f31675b4b18e0bc2764","source":"amazon-inspector","versions":["1.1.52"]},{"id":"IN-MAL-2026-016561","import_time":"2026-08-06T14:19:55.416640164Z","modified_time":"2026-08-06T14:13:33Z","sha256":"0e4f917d64f544bfb61447ee39df17c6ec4723f1fa681d57605b9a9d2d88e752","source":"amazon-inspector","versions":["1.3.21"]},{"id":"IN-MAL-2026-016578","import_time":"2026-08-06T14:19:55.929235678Z","modified_time":"2026-08-06T14:16:01Z","sha256":"52b1477c5187703dab87d6be6933d62de4c4244ab3340586f85b530e05470aa1","source":"amazon-inspector","versions":["1.1.51"]},{"id":"IN-MAL-2026-016584","import_time":"2026-08-06T14:19:56.250985661Z","modified_time":"2026-08-06T14:16:59Z","sha256":"f2bc78f91b7358c8a49eee890fe0e399f65c131dd45c4fb1c988ceee3ec0c68b","source":"amazon-inspector","versions":["1.3.4"]},{"id":"IN-MAL-2026-016569","import_time":"2026-08-06T14:19:55.660900468Z","modified_time":"2026-08-06T14:14:42Z","sha256":"fa606654f20a78ae48039cf7fda911e20fb3f367a94d1c046c210f78e62515bc","source":"amazon-inspector","versions":["1.3.7"]},{"id":"IN-MAL-2026-016581","import_time":"2026-08-06T14:19:56.106530712Z","modified_time":"2026-08-06T14:16:30Z","sha256":"fa862fc18478ee5be3da3ed42fc0e43f1d770e602732ddb7ad78657f5cf8bc43","source":"amazon-inspector","versions":["1.3.28"]},{"id":"IN-MAL-2026-016583","import_time":"2026-08-06T14:19:56.218441305Z","modified_time":"2026-08-06T14:16:49Z","sha256":"c7dd771763426495461120c20782ffd986494783c3120a25c5d810d256542f35","source":"amazon-inspector","versions":["1.3.37"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}