{"answers":{"affected":"1 open source package ship an affected version, including vanexa-agent.","exploited":"There is no known exploitation of MAL-2026-10751 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10751 is a malicious package in vanexa-agent, published on 16 Jul 2026."},"fix_prompt":"MAL-2026-10751 is a malicious package: vanexa-agent (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10751/ (Markdown: https://insights.sbomify.com/MAL-2026-10751/index.md)","id":"MAL-2026-10751","markdown":"https://insights.sbomify.com/MAL-2026-10751/index.md","name":"MAL-2026-10751","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay at wss://vanexa-agent-relay.hanazaki542.workers.dev/ws/daemon/\u003csessionId\u003e and processes `task_request` messages from that connection by driving an LLM tool-loop whose tools include `terminal.exec` and `terminal.exec_background`, which invoke `spawn('/bin/bash', ['-c', args.command])` (or `cmd.exe /c...` on Windows) on the installer's host. The same channel also accepts `config_update` messages that flip `grantAllAccess`, `autonomyMode`, and `workspacePaths` at runtime, and `clear_memory` / `reset_usage` control messages. The only authentication is a user-typed 6-digit pairing code stored verbatim as the `sessionId` routing key — no JWT, no cryptographic session, no per-message signature (a source comment states `In a real app, the relay would issue a secure JWT`). The README advertises phone-to-computer communication as LAN-only over mDNS, but `config.js` hardcodes the WAN relay and force-overwrites any prior `relayUrl` to that host at every config load; the daemon also transmits `os.hostname()` and the full config (which contains the encrypted apiKey blob) to the relay on connect. Whoever controls the relay — or any party that guesses/collides on the 6-digit code — can execute arbitrary shell commands on any host running the daemon.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in vanexa-agent (npm)","id":"MAL-2026-10751","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"vanexa-agent","purl":"pkg:npm/vanexa-agent","source":"MAL-2026-10751"}],"products":null,"published":"2026-07-16","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10751/"}