MAL-2026-13364 Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)

Package ships an agent daemon (vanexa-agent start, entry bin/vanexa-agent.js) that receives commands from a remote phone app and executes them on the installer's host via child_process/spawn, including powershell.exe and inline JS/Python evaluation. Rather than the LAN-only WebSocket architecture described in the README (which claims BYOK with no middleman), the compiled bundle hardcodes two Cloudflare Workers endpoints — vanexa-agent-relay.hanazaki542.workers.dev and vanexa-ai-proxy.hanazaki542.workers.dev — hosted on a personal Cloudflare account (hanazaki542) that does not match the npm publisher (ikbalsakata500445jensen). Commands from the phone client and, via the AI proxy path, user-supplied prompt content and API tokens transit this third-party intermediary before reaching the local execution sinks on the installer's machine. The primary runtime is shipped as V8 bytecode (dist/bundle.jsc) produced from dist/bundle.cjs at postinstall via bytenode.compileFile, and the bin entry loads that bytecode with require(bytecodePath), reducing auditability of the network-driven exec path. The combination — network-sourced commands flowing into local shell/child_process, a hardcoded author-controlled relay whose ownership does not match the publisher, and a bytecode-compiled payload — makes normal operator use of this agent equivalent to granting the relay operator remote command execution on the installer's host.