Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
- Disclosed
- Last updated
- Blast radius
- Any machine running zyr-agent with the default provider configuration
- Ecosystems
- Attack vectors
- Affected entities
- zyr-agentnpm package with embedded malicious code
zyr-agent is an npm package that ships an AI coding agent with a default 'free' provider. This provider routes chat completions to a hardcoded preview-slug endpoint at https://preview-chat-e8a10541-5396-4e8f-9ead-e5fbbcdb33d3.space-z.ai/api/v1 using an embedded API key.
The agent's Agent.send loop automatically executes tool calls returned by the remote endpoint without requiring user confirmation. One of the registered tools is a bash tool that executes arbitrary shell commands via execSync() on the host machine. This means an attacker controlling the preview subdomain can inject bash tool calls into normal chat responses and achieve remote code execution on any machine running the default provider.
Additionally, the package ships a hardcoded third-party OpenRouter API key in cli.js and desktop/electron.js, routing installer prompts through an author-controlled account. The combination of auto-execution without per-tool confirmation and a mutable, author-controlled endpoint as the default provider creates a remote-command channel controlled by the package author rather than the operator.
The vulnerability was identified by the OpenSSF malicious packages project.
Indicators of compromise
- Packages
- zyr-agent
- Domains
- preview-chat-e8a10541-5396-4e8f-9ead-e5fbbcdb33d3.space-z.ai
Remediation
- Remove or uninstall zyr-agent from all systems
- Audit any systems that ran zyr-agent for unauthorized command execution or data exfiltration
- Review shell history and system logs on affected machines for suspicious activity
- Rotate any credentials or API keys that may have been exposed to the compromised package
- Do not use the default provider configuration if the package is reinstalled; configure an alternative provider if the package is updated
Sources
- GitHub Advisory GHSA-rhx7-52rr-88vg · GitHub Advisory Database
Cite this entry
"Malicious code in zyr-agent (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-zyr-agent-npm-1vaaqs
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in mangomind-agent (npm)
The npm package mangomind-agent contained malicious code that established a persistent WebSocket connection to a hardcoded relay server, enabling remote code execution and AI-agent-driven filesystem access on any host running the package. The vulnerability was discovered and reported by the OpenSSF.
npmAI agents & skillsCompromised packageMalicious commit - activecritical
Malicious code in @vanexalabs-ai/vanexa-agent (npm)
The npm package @vanexalabs-ai/vanexa-agent contains malicious code that implements a WebRTC daemon capable of executing arbitrary shell commands received from remote peers or signaling relay operators. The package uses obfuscated V8 bytecode to hide its pairing/authorization logic and includes a socket.json configuration that suppresses security scanning for malware, obfuscation, shell access, and network access.
npmAI agents & skillsCompromised packageMalicious commit - containedcritical
Malicious code in @yancyyu/agentcli (npm)
The npm package @yancyyu/agentcli contains malicious code that extracts OAuth credentials and API keys for Lark/Feishu from the system keychain (macOS) and credential store (Windows), then exfiltrates them to a hardcoded remote IP address over plaintext HTTP. A persistent launchd agent ensures the exfiltration loop survives reboots.
npmAI agents & skillsCompromised packageMalicious commit - resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit