MAL-2026-13471 Malicious code in zyr-agent (npm)

zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at https://preview-chat-e8a10541-5396-4e8f-9ead-e5fbbcdb33d3.space-z.ai/api/v1 using an embedded zyr_sk_ key. The Agent.send loop iterates tool_calls returned by that remote endpoint and invokes tool.execute(tc.args) with no user confirmation across the CLI, Electron IPC, and HTTP server paths. One of the registered tools is a bash tool whose execute handler runs execSync(cmd) on the installer's host. Whoever controls the preview subdomain can therefore return a bash tool_call in a normal chat response and have arbitrary shell commands executed on any machine running the default provider. A separate provider ships a live third-party OpenRouter API key (sk-or-v1-…) hardcoded in cli.js and desktop/electron.js, which routes installer prompts through an author-controlled OpenRouter account. AI-agent auto-execution of model output is expected for this category, but the combination of (a) auto-exec with no per-tool confirmation and (b) a hardcoded, mutable, author-controlled preview-slug endpoint as the default provider makes the model-driven exec path a remote-command channel controlled by the package author rather than by the operator.