MAL-2026-13471

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zyr-agent/MAL-2026-13471.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13471
Published
2026-08-06T19:21:22Z
Modified
2026-08-06T23:50:30Z
Summary
Malicious code in zyr-agent (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c)

zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at https://preview-chat-e8a10541-5396-4e8f-9ead-e5fbbcdb33d3.space-z.ai/api/v1 using an embedded zyr_sk_ key. The Agent.send loop iterates tool_calls returned by that remote endpoint and invokes tool.execute(tc.args) with no user confirmation across the CLI, Electron IPC, and HTTP server paths. One of the registered tools is a bash tool whose execute handler runs execSync(cmd) on the installer's host. Whoever controls the preview subdomain can therefore return a bash tool_call in a normal chat response and have arbitrary shell commands executed on any machine running the default provider. A separate provider ships a live third-party OpenRouter API key (sk-or-v1-...) hardcoded in cli.js and desktop/electron.js, which routes installer prompts through an author-controlled OpenRouter account. AI-agent auto-execution of model output is expected for this category, but the combination of (a) auto-exec with no per-tool confirmation and (b) a hardcoded, mutable, author-controlled preview-slug endpoint as the default provider makes the model-driven exec path a remote-command channel controlled by the package author rather than by the operator.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016763",
            "import_time": "2026-08-06T23:25:08.10848942Z",
            "modified_time": "2026-08-06T19:21:22Z",
            "sha256": "5828a7ed3adec522b0ace6b4e7962f48ff5e8b5853ef251d5db81df0b4f08fc0",
            "source": "amazon-inspector",
            "versions": [
                "1.6.2"
            ]
        },
        {
            "id": "IN-MAL-2026-016764",
            "import_time": "2026-08-06T23:25:08.14173861Z",
            "modified_time": "2026-08-06T19:21:32Z",
            "sha256": "b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c",
            "source": "amazon-inspector",
            "versions": [
                "1.5.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / zyr-agent

Package

Name
zyr-agent
View open source insights on deps.dev
Purl
pkg:npm/zyr-agent

Affected ranges

Affected versions

1.*
1.5.7
1.6.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/tools/bash.js",
            "sha256": "76521ee2375334ed41da0d301e36819a11272851a5e1788c579e7609f7824314",
            "tlsh": "e42190165ef9632543af745409962542f1a772c37e2cac61f64dc9601f0e45c90b53d8"
        },
        {
            "path": "dist/desktop/electron.js",
            "sha256": "298182aca6c630ee6ba2746f8e4ba7a8c36523b0fd3c1b2b02ab3c74129dee91",
            "tlsh": "cbd18463b4b715a002725d9e3d1b9522b7b4a2973a04f81071dec7a0ffce439c6a62dd"
        }
    ],
    "package_integrity": [
        {
            "filename": "zyr-agent-1.6.2.tgz",
            "hashes": {
                "sha1": "0c4593199396001de8323ae90f7d2c2f2d0d5df4",
                "sha512_sri": "sha512-ye62ilsBKnnFkjVAyHJ8xRy9Q3kUpoNukxrWSSFEWx5GLEl2kEViMqhrr+eD6Hccx6ebkvuIyOfBXsRjEjF6HQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zyr-agent/MAL-2026-13471.json"