zyr-agent

{"modified":"2026-08-06T23:29:22Z","published":"2026-08-06T19:21:22Z","schema_version":"1.7.4","id":"MAL-2026-13471","summary":"Malicious code in zyr-agent (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c)\nzyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at https://preview-chat-e8a10541-5396-4e8f-9ead-e5fbbcdb33d3.space-z.ai/api/v1 using an embedded zyr_sk_ key. The Agent.send loop iterates tool_calls returned by that remote endpoint and invokes tool.execute(tc.args) with no user confirmation across the CLI, Electron IPC, and HTTP server paths. One of the registered tools is a bash tool whose execute handler runs execSync(cmd) on the installer's host. Whoever controls the preview subdomain can therefore return a bash tool_call in a normal chat response and have arbitrary shell commands executed on any machine running the default provider. A separate provider ships a live third-party OpenRouter API key (sk-or-v1-...) hardcoded in cli.js and desktop/electron.js, which routes installer prompts through an author-controlled OpenRouter account. AI-agent auto-execution of model output is expected for this category, but the combination of (a) auto-exec with no per-tool confirmation and (b) a hardcoded, mutable, author-controlled preview-slug endpoint as the default provider makes the model-driven exec path a remote-command channel controlled by the package author rather than by the operator.\n","affected":[{"package":{"ecosystem":"npm","name":"zyr-agent"},"versions":["1.6.2","1.5.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/tools/bash.js","sha256":"76521ee2375334ed41da0d301e36819a11272851a5e1788c579e7609f7824314","tlsh":"e42190165ef9632543af745409962542f1a772c37e2cac61f64dc9601f0e45c90b53d8"},{"path":"dist/desktop/electron.js","sha256":"298182aca6c630ee6ba2746f8e4ba7a8c36523b0fd3c1b2b02ab3c74129dee91","tlsh":"cbd18463b4b715a002725d9e3d1b9522b7b4a2973a04f81071dec7a0ffce439c6a62dd"}],"package_integrity":[{"filename":"zyr-agent-1.6.2.tgz","hashes":{"sha1":"0c4593199396001de8323ae90f7d2c2f2d0d5df4","sha512_sri":"sha512-ye62ilsBKnnFkjVAyHJ8xRy9Q3kUpoNukxrWSSFEWx5GLEl2kEViMqhrr+eD6Hccx6ebkvuIyOfBXsRjEjF6HQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zyr-agent/v/1.6.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/zyr-agent/v/1.5.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016763","import_time":"2026-08-06T23:25:08.10848942Z","modified_time":"2026-08-06T19:21:22Z","sha256":"5828a7ed3adec522b0ace6b4e7962f48ff5e8b5853ef251d5db81df0b4f08fc0","source":"amazon-inspector","versions":["1.6.2"]},{"id":"IN-MAL-2026-016764","import_time":"2026-08-06T23:25:08.14173861Z","modified_time":"2026-08-06T19:21:32Z","sha256":"b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c","source":"amazon-inspector","versions":["1.5.7"]}]}}