MAL-2026-13364

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ikbal_fadilah_vanexa01/vanexa-agent/MAL-2026-13364.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13364

Published

2026-08-05T18:16:17Z

Modified

2026-08-06T14:34:47.732685815Z

Summary

Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (52b1477c5187703dab87d6be6933d62de4c4244ab3340586f85b530e05470aa1)

Package ships an agent daemon (vanexa-agent start, entry bin/vanexa-agent.js) that receives commands from a remote phone app and executes them on the installer's host via child_process/spawn, including powershell.exe and inline JS/Python evaluation. Rather than the LAN-only WebSocket architecture described in the README (which claims BYOK with no middleman), the compiled bundle hardcodes two Cloudflare Workers endpoints — vanexa-agent-relay.hanazaki542.workers.dev and vanexa-ai-proxy.hanazaki542.workers.dev — hosted on a personal Cloudflare account (hanazaki542) that does not match the npm publisher (ikbalsakata500445jensen). Commands from the phone client and, via the AI proxy path, user-supplied prompt content and API tokens transit this third-party intermediary before reaching the local execution sinks on the installer's machine. The primary runtime is shipped as V8 bytecode (dist/bundle.jsc) produced from dist/bundle.cjs at postinstall via bytenode.compileFile, and the bin entry loads that bytecode with require(bytecodePath), reducing auditability of the network-driven exec path. The combination — network-sourced commands flowing into local shell/child_process, a hardcoded author-controlled relay whose ownership does not match the publisher, and a bytecode-compiled payload — makes normal operator use of this agent equivalent to granting the relay operator remote command execution on the installer's host.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015847",
            "import_time": "2026-08-05T19:04:54.214569101Z",
            "sha256": "481daae8905848ad63e1ea0680645761de3594c5eaa017e9e6f6ea8fe6e2282e",
            "modified_time": "2026-08-05T18:16:17Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.10"
            ]
        },
        {
            "id": "IN-MAL-2026-016556",
            "import_time": "2026-08-06T14:19:55.287823593Z",
            "sha256": "d9f41ee3ef2d3e711f00b2d2f5df471d2c2c1f4e7be9b4563017526c23bd14b3",
            "modified_time": "2026-08-06T14:12:48Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.19"
            ]
        },
        {
            "id": "IN-MAL-2026-016582",
            "import_time": "2026-08-06T14:19:56.185108049Z",
            "sha256": "1694969f49b4c30e299fc9b51dd60e8e24faa97c853c663b5fad018cf6ed7163",
            "versions": [
                "1.3.23"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:16:39Z"
        },
        {
            "id": "IN-MAL-2026-016587",
            "import_time": "2026-08-06T14:19:56.341893951Z",
            "sha256": "57c73c2e900eee675453cbc41cad5992640f1f9051bd49ea789b16a13328e8d4",
            "modified_time": "2026-08-06T14:17:23Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.53"
            ]
        },
        {
            "import_time": "2026-08-06T14:19:55.315355765Z",
            "id": "IN-MAL-2026-016557",
            "sha256": "60838012b6a1c5baf88d9034d495dcfad4b4b4bed2eca7740214896931823e6d",
            "modified_time": "2026-08-06T14:12:58Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.17"
            ]
        },
        {
            "id": "IN-MAL-2026-016579",
            "import_time": "2026-08-06T14:19:55.957209714Z",
            "sha256": "f01d8891e773a84f7171ba737ee556bc7116dccd30c73f090dc24f24143ad82f",
            "modified_time": "2026-08-06T14:16:08Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.8"
            ]
        },
        {
            "id": "IN-MAL-2026-016574",
            "import_time": "2026-08-06T14:19:55.813666372Z",
            "sha256": "ffd15f555cf1d4e138b64b2ede6dbdacacde6cbd4412f3791a3a54f25b81d655",
            "versions": [
                "1.1.54"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:15:24Z"
        },
        {
            "id": "IN-MAL-2026-016558",
            "import_time": "2026-08-06T14:19:55.338612074Z",
            "sha256": "0fe7fb20ec36246992d1b4faaa2b1e5afae4e37cda843fc6ae7848dfc2b3f8f2",
            "versions": [
                "1.2.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:13:07Z"
        },
        {
            "id": "IN-MAL-2026-016571",
            "import_time": "2026-08-06T14:19:55.719577915Z",
            "sha256": "78ba42c806346cb3d718d37a576e5237be553c0c00dfe9c27f224fb96962b4f9",
            "modified_time": "2026-08-06T14:14:58Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.55"
            ]
        },
        {
            "id": "IN-MAL-2026-016565",
            "import_time": "2026-08-06T14:19:55.532014166Z",
            "sha256": "92597f62bf4b6df199a7784aa71dfbf9b9e40b59f9580bec8e782e6312940428",
            "modified_time": "2026-08-06T14:14:07Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.34"
            ]
        },
        {
            "id": "IN-MAL-2026-016586",
            "import_time": "2026-08-06T14:19:56.308677854Z",
            "sha256": "9a7cf61c610e5a38f9efbba3a984886acd7d6e933e95bbbeffc526b9592f3ee3",
            "versions": [
                "1.3.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:17:13Z"
        },
        {
            "id": "IN-MAL-2026-016576",
            "import_time": "2026-08-06T14:19:55.872579523Z",
            "sha256": "aaf0c2e39ba69473adfb41e866f8faeb413c8ca83136bae9a78710192d7aa8fd",
            "versions": [
                "1.1.58"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:15:41Z"
        },
        {
            "id": "IN-MAL-2026-016575",
            "import_time": "2026-08-06T14:19:55.84274063Z",
            "sha256": "ad5455301be007ba880e5dc2a4e7912fa761ca2d2fd83f027d6560a3b6a93e7c",
            "versions": [
                "1.1.59"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:15:34Z"
        },
        {
            "id": "IN-MAL-2026-016560",
            "import_time": "2026-08-06T14:19:55.392726854Z",
            "sha256": "aead634b0fe8b0dd2adf56d74a20306c7a53def0da70ba15fdce13785fea8af6",
            "versions": [
                "1.3.14"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:13:23Z"
        },
        {
            "id": "IN-MAL-2026-016572",
            "import_time": "2026-08-06T14:19:55.750823325Z",
            "sha256": "b8174bacba0ef373f43333e2ede4dfe730ed4d8675f32766f1a97de25f9e3566",
            "versions": [
                "1.3.32"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:15:09Z"
        },
        {
            "id": "IN-MAL-2026-016589",
            "import_time": "2026-08-06T14:19:56.40186931Z",
            "sha256": "daeb89ff38231ef6701b4402aab97c44d5709148a8be71f0751458e0393f7964",
            "versions": [
                "1.3.44"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:17:42Z"
        },
        {
            "import_time": "2026-08-06T14:19:56.369362333Z",
            "id": "IN-MAL-2026-016588",
            "sha256": "356fd03c2bd7c9bafd3a3d1f4e21f2b982f364c1f9035440802108ab6fcac764",
            "modified_time": "2026-08-06T14:17:30Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.9"
            ]
        },
        {
            "import_time": "2026-08-06T14:19:55.558405417Z",
            "id": "IN-MAL-2026-016566",
            "sha256": "5879d9167255b615df85872c600553d5b2c83b99420ff34806c393bceaa86661",
            "modified_time": "2026-08-06T14:14:15Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.40"
            ]
        },
        {
            "id": "IN-MAL-2026-016563",
            "import_time": "2026-08-06T14:19:55.478945933Z",
            "sha256": "cd6e2b04b9a1b32cde1e1f7f9b06ed1b553c02a4791489f849acac8080285a23",
            "versions": [
                "1.3.29"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:13:49Z"
        },
        {
            "id": "IN-MAL-2026-016559",
            "import_time": "2026-08-06T14:19:55.367687329Z",
            "sha256": "ceef7861c370625085d1a0725922c8a184265a335c31095529a8dd58f04c58f7",
            "versions": [
                "1.3.15"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:13:15Z"
        },
        {
            "id": "IN-MAL-2026-016564",
            "import_time": "2026-08-06T14:19:55.504390632Z",
            "sha256": "049497a6b0aafd1f65a52984e227c333c0809946fa5cd4c899062e442fd5fdfb",
            "versions": [
                "1.3.31"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:13:58Z"
        },
        {
            "id": "IN-MAL-2026-016570",
            "import_time": "2026-08-06T14:19:55.690192475Z",
            "sha256": "10b28cb6809fceca186b78441fa1469c355bc4d2cba5ec5a826bf91df5b1a6b8",
            "versions": [
                "1.1.56"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:14:51Z"
        },
        {
            "id": "IN-MAL-2026-016573",
            "import_time": "2026-08-06T14:19:55.781052083Z",
            "sha256": "cdb7a39c047dcbc3b1bea5beb43d9b6bcabc631e604ba0cbf903e95ed17c4016",
            "versions": [
                "1.1.57"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:15:17Z"
        },
        {
            "import_time": "2026-08-06T14:19:55.446145559Z",
            "id": "IN-MAL-2026-016562",
            "sha256": "ef6d2ea845e3d127d15ee799d878dee6655365eacb5dc306f564d59a891ebdf9",
            "modified_time": "2026-08-06T14:13:41Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.27"
            ]
        },
        {
            "id": "IN-MAL-2026-016585",
            "import_time": "2026-08-06T14:19:56.279451118Z",
            "sha256": "367330aab67ac352c10ddb6e142dade22d8111ce38bd1522270a54f34dcd05f2",
            "versions": [
                "1.3.35"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:17:06Z"
        },
        {
            "id": "IN-MAL-2026-016568",
            "import_time": "2026-08-06T14:19:55.635724898Z",
            "sha256": "5037e0458321aa0485797aca70eecf5781d98d547e0b7ab736e0a13169a20509",
            "versions": [
                "1.3.6"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:14:30Z"
        },
        {
            "id": "IN-MAL-2026-016567",
            "import_time": "2026-08-06T14:19:55.606110252Z",
            "sha256": "7f717cd4c6b774f55fe369a298f16814c3cdf0c0e34733c54fa373319a81080f",
            "versions": [
                "1.3.45"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:14:22Z"
        },
        {
            "id": "IN-MAL-2026-016580",
            "import_time": "2026-08-06T14:19:55.988650418Z",
            "sha256": "8539ccd87d3b47388e734dcca16f8cb2569eccddc83d3f6a7eda3c08b3dc9a8b",
            "versions": [
                "1.3.12"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:16:20Z"
        },
        {
            "id": "IN-MAL-2026-016577",
            "import_time": "2026-08-06T14:19:55.899546475Z",
            "sha256": "f1e2e6e78b5768af12f029dd2151f4a833905cb9aefa8f31675b4b18e0bc2764",
            "versions": [
                "1.1.52"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:15:51Z"
        },
        {
            "id": "IN-MAL-2026-016561",
            "import_time": "2026-08-06T14:19:55.416640164Z",
            "sha256": "0e4f917d64f544bfb61447ee39df17c6ec4723f1fa681d57605b9a9d2d88e752",
            "modified_time": "2026-08-06T14:13:33Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.21"
            ]
        },
        {
            "import_time": "2026-08-06T14:19:55.929235678Z",
            "id": "IN-MAL-2026-016578",
            "sha256": "52b1477c5187703dab87d6be6933d62de4c4244ab3340586f85b530e05470aa1",
            "modified_time": "2026-08-06T14:16:01Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.51"
            ]
        },
        {
            "id": "IN-MAL-2026-016584",
            "import_time": "2026-08-06T14:19:56.250985661Z",
            "sha256": "f2bc78f91b7358c8a49eee890fe0e399f65c131dd45c4fb1c988ceee3ec0c68b",
            "modified_time": "2026-08-06T14:16:59Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.4"
            ]
        },
        {
            "id": "IN-MAL-2026-016569",
            "import_time": "2026-08-06T14:19:55.660900468Z",
            "sha256": "fa606654f20a78ae48039cf7fda911e20fb3f367a94d1c046c210f78e62515bc",
            "versions": [
                "1.3.7"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T14:14:42Z"
        },
        {
            "import_time": "2026-08-06T14:19:56.106530712Z",
            "id": "IN-MAL-2026-016581",
            "sha256": "fa862fc18478ee5be3da3ed42fc0e43f1d770e602732ddb7ad78657f5cf8bc43",
            "modified_time": "2026-08-06T14:16:30Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.28"
            ]
        },
        {
            "id": "IN-MAL-2026-016583",
            "import_time": "2026-08-06T14:19:56.218441305Z",
            "sha256": "c7dd771763426495461120c20782ffd986494783c3120a25c5d810d256542f35",
            "modified_time": "2026-08-06T14:16:49Z",
            "source": "amazon-inspector",
            "versions": [
                "1.3.37"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @ikbal_fadilah_vanexa01/vanexa-agent

Package

Name: @ikbal_fadilah_vanexa01/vanexa-agent; View open source insights on deps.dev
Purl: pkg:npm/%40ikbal_fadilah_vanexa01/vanexa-agent

Affected ranges

Affected versions

1.*

1.1.51

1.1.52

1.1.53

1.1.54

1.1.55

1.1.56

1.1.57

1.1.58

1.1.59

1.2.0

1.3.3

1.3.4

1.3.6

1.3.7

1.3.8

1.3.9

1.3.10

1.3.12

1.3.14

1.3.15

1.3.17

1.3.19

1.3.21

1.3.23

1.3.27

1.3.28

1.3.29

1.3.31

1.3.32

1.3.34

1.3.35

1.3.37

1.3.40

1.3.44

1.3.45

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ikbal_fadilah_vanexa01/vanexa-agent/MAL-2026-13364.json"

indicators

{
    "evidence_files": [
        {
            "path": "dist/bundle.cjs",
            "tlsh": "ac955c6d73a6766123e760e4cc36010ae16999581809d539f3fcf8e7bb52888c1e7f78",
            "sha256": "d65ded4a78096774ff3a08dfe8e994e46dd078fa933f541063aacef92218ebf2"
        }
    ],
    "package_integrity": [
        {
            "filename": "vanexa-agent-1.3.10.tgz",
            "hashes": {
                "sha1": "663b134e9d4d02f32154f19fb0b339e8422becda",
                "sha512_sri": "sha512-KitccSWWSe6IeiMRGwFUwMzP59SlWWIg367nOE8gD13g0lf1d70IEHR3s5VJ1v2pg8UxWJkq8OZuYrlEJ5WMUg=="
            }
        }
    ]
}