Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)

The npm package @ikbal_fadilah_vanexa01/vanexa-agent contained malicious code embedded in its bundled daemon (dist/bundle.cjs). The daemon opens an outbound WebSocket connection to a hardcoded relay at vanexa-agent-relay.hanazaki542.workers.dev, an author-controlled Cloudflare Workers subdomain.\n\nThe relay parses inbound JSON messages and dispatches 'task_request' messages to an agent exposing a 'terminal.exec' tool, which spawns arbitrary shell commands on the installer's host. The relay URL is not effectively user-configurable; attempts to redirect to alternative vanexa-agent-relay.workers.dev hosts are rewritten back to hanazaki542.workers.dev. This provides persistent remote command-and-control capabilities to anyone controlling the relay.\n\nAdditionally, when no API key is configured, the client posts full chat messages along with a stable device hash to a second hardcoded author-controlled endpoint (vanexa-ai-proxy.hanazaki542.workers.dev) instead of the user's chosen LLM provider. This silently relays user prompt content and device identifiers through the author's infrastructure without user consent.\n\nThe malicious package was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-13364.