MAL-2026-14047

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@guangnao/agent-proxy/MAL-2026-14047.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-14047

Published

2026-08-14T19:42:12Z

Modified

2026-08-14T20:00:12Z

Summary

Malicious code in @guangnao/agent-proxy (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06)

On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub.client-llm.com, reconstructed at runtime via XOR+base64 with key 'gnP2p!7xQ' from a base64 blob in dist/cli.js) and accepts remote job messages containing arbitrary path and body fields. These are POSTed into the local proxy and forwarded to api.anthropic.com and the Codex/ChatGPT upstream using the installer's on-disk OAuth credentials, with responses streamed back to the hub. An onlyIfCredentialed gate ensures only installers with valid Claude/Codex logins are enrolled as worker nodes serving requests originated by the hub operator. The behavior is undocumented; the README states the tool is 'self-use only' and warns that upstream vendor ToS forbid resale or sharing of accounts. The destination URL is not present as a plaintext string, only reconstructed at runtime, concealing it from casual review. The combination provides a remote-controlled command channel (arbitrary request path/body) into the installer's authenticated AI session and silently monetizes the installer's paid subscription for the hub operator's traffic.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017923",
            "import_time": "2026-08-14T19:49:49.896567358Z",
            "modified_time": "2026-08-14T19:42:33Z",
            "sha256": "894c7feb1f9f6c277d5eb3d7b5f2de015c2e698cce1663442889221a205aa4a0",
            "source": "amazon-inspector",
            "versions": [
                "1.2.1"
            ]
        },
        {
            "id": "IN-MAL-2026-017921",
            "import_time": "2026-08-14T19:49:49.805257102Z",
            "modified_time": "2026-08-14T19:42:12Z",
            "sha256": "8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06",
            "source": "amazon-inspector",
            "versions": [
                "1.4.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017922",
            "import_time": "2026-08-14T19:49:49.840739949Z",
            "modified_time": "2026-08-14T19:42:25Z",
            "sha256": "cd3c0648f70b72257a9302c46ee8abc435015edcedaa560560870b7f0b98b5ed",
            "source": "amazon-inspector",
            "versions": [
                "1.4.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @guangnao/agent-proxy

Package

Name: @guangnao/agent-proxy; View open source insights on deps.dev
Purl: pkg:npm/%40guangnao/agent-proxy

Affected ranges

Affected versions

1.*

1.2.1

1.4.0

1.4.2

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "dist/cli.js",
            "sha256": "d12f5774b17a81a948114de309a2be9e14b646a92ead01983c7b4064b2262a55",
            "tlsh": "9df35b85a27e353b4bed52e1787e0506f3a885a46518802cb32cddef2e6c80455bff79"
        }
    ],
    "package_integrity": [
        {
            "filename": "agent-proxy-1.2.1.tgz",
            "hashes": {
                "sha1": "a1458fd5e69edd65487b4af15de227127b2dc321",
                "sha512_sri": "sha512-bzX5N7ZbG+GtbgC2QrIKeA/vGoW/waA9oXOae/NyxS26H8ox9Uw0i+HKqdRokC/XbpG3fSo/Bgwzvd6EbOw+4A=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@guangnao/agent-proxy/MAL-2026-14047.json"