# MAL-2026-14047: Malicious code in @guangnao/agent-proxy (npm)


- **Type:** Malicious package
- **Package:** `@guangnao/agent-proxy` (npm)
- **Published:** 14 Aug 2026

## What is MAL-2026-14047?

MAL-2026-14047 is a malicious package in @guangnao/agent-proxy, published on 14 Aug 2026. 

### Official description

On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub.client-llm.com, reconstructed at runtime via XOR+base64 with key 'gnP2p!7xQ' from a base64 blob in dist/cli.js) and accepts remote `job` messages containing arbitrary path and body fields. These are POSTed into the local proxy and forwarded to api.anthropic.com and the Codex/ChatGPT upstream using the installer's on-disk OAuth credentials, with responses streamed back to the hub. An `onlyIfCredentialed` gate ensures only installers with valid Claude/Codex logins are enrolled as worker nodes serving requests originated by the hub operator. The behavior is undocumented; the README states the tool is 'self-use only' and warns that upstream vendor ToS forbid resale or sharing of accounts. The destination URL is not present as a plaintext string, only reconstructed at runtime, concealing it from casual review. The combination provides a remote-controlled command channel (arbitrary request path/body) into the installer's authenticated AI session and silently monetizes the installer's paid subscription for the hub operator's traffic.

## What should I do about MAL-2026-14047?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14047 is a malicious package: @guangnao/agent-proxy (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14047/ (Markdown: https://insights.sbomify.com/MAL-2026-14047/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14047

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14047/
Summaries are generated and may contain mistakes; the official description above is the record.