@agent-native/core

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

Spreading entire process.env into an object — may capture all secrets 71 | args, 72 | { > 73 | env: this.env ? { ...process.env, ...this.env } : process.env, 74 | cwd: this.cwd, 75 | timeout: this.timeoutMs,

Spreading entire process.env into an object — may capture all secrets 117 | sessionOptions.cwd ?? options.cwd ?? process.cwd(), 118 | ); > 119 | const env: NodeJS.ProcessEnv = { 120 | ...process.env, 121 | ...(options.env ?? {}),

Spreading entire process.env into an object — may capture all secrets 5 | const TIMEOUT = 10_000; 6 | > 7 | const CHECKPOINT_ENV = { 8 | ...process.env, 9 | GIT_AUTHOR_NAME: "agent-native",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1191 | : "xdg-open"; 1192 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 1193 | const child = spawn(command, args, { 1194 | detached: true, 1195 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1191 | : "xdg-open"; 1192 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 1193 | const child = spawn(command, args, { 1194 | detached: true, 1195 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 480 | detached: true, 481 | stdio: ["ignore", "pipe", "pipe"], > 482 | env: { 483 | ...process.env, 484 | AGENT_NATIVE_CODE_AGENTS_HOME: codeAgentStoreRoot(),

Silent detached process — runs invisibly in the background (reverse shells, miners) 644 | const openArgs = 645 | process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 646 | const child = spawn(command, openArgs, { 647 | stdio: "ignore", 648 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 644 | const openArgs = 645 | process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 646 | const child = spawn(command, openArgs, { 647 | stdio: "ignore", 648 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 303 | : "xdg-open"; 304 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 305 | const child = spawn(command, args, { 306 | detached: true, 307 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 303 | : "xdg-open"; 304 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 305 | const child = spawn(command, args, { 306 | detached: true, 307 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 356 | stdio: "inherit", 357 | shell: process.platform === "win32", > 358 | env: { ...process.env, ...plan.env }, 359 | }); 360 |

Spreading entire process.env into an object — may capture all secrets 1894 | cwd: dir, 1895 | stdio: "pipe", > 1896 | env: { 1897 | ...process.env, 1898 | GIT_AUTHOR_NAME: "agent-native",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1118 | 1119 | const invocation = resolveCurrentCliInvocation(argv); > 1120 | const child = spawn(invocation.command, invocation.args, { 1121 | cwd: process.cwd(), 1122 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 1118 | 1119 | const invocation = resolveCurrentCliInvocation(argv); > 1120 | const child = spawn(invocation.command, invocation.args, { 1121 | cwd: process.cwd(), 1122 | detached: true,

Spreading entire process.env into an object — may capture all secrets 458 | shell: true, 459 | stdio: ["pipe", "pipe", "pipe"], > 460 | env: { ...process.env, FORCE_COLOR: "0" }, 461 | }); 462 | let stdout = "";

Spreading entire process.env into an object — may capture all secrets 510 | stdio: ["ignore", logFd, logFd], 511 | detached: true, > 512 | env: { ...process.env, FORCE_COLOR: "0" }, 513 | }); 514 | child.unref();

Spreading entire process.env into an object — may capture all secrets 1429 | execFileSync(process.execPath, [renderScript], { 1430 | cwd, > 1431 | env: { 1432 | ...process.env, 1433 | NODE_ENV: process.env.NODE_ENV || "production",

URL pointing to known exfiltration/tunneling service 186 | try { 187 | const res = await fetch( > 188 | `https://api.telegram.org/bot${token}/sendMessage`, 189 | { 190 | method: "POST",

URL pointing to known exfiltration/tunneling service 204 | // Retry without Markdown if parsing fails 205 | if (data.description?.includes("parse")) { > 206 | await fetch(`https://api.telegram.org/bot${token}/sendMessage`, { 207 | method: "POST", 208 | headers: { "Content-Type": "application/json" },

URL pointing to known exfiltration/tunneling service 244 | try { 245 | const res = await fetch( > 246 | `https://api.telegram.org/bot${token}/sendMessage`, 247 | { 248 | method: "POST",

URL pointing to known exfiltration/tunneling service 280 | if (hasToken) { 281 | try { > 282 | const res = await fetch(`https://api.telegram.org/bot${token}/getMe`); 283 | const data = (await res.json()) as { 284 | ok: boolean;

URL pointing to known exfiltration/tunneling service 1656 | try { 1657 | const res = await fetch( > 1658 | `https://api.telegram.org/bot${token}/setWebhook`, 1659 | { 1660 | method: "POST",

Spreading entire process.env into an object — may capture all secrets 74 | 75 | function childProcessEnvForRequest(): NodeJS.ProcessEnv { > 76 | const env = { ...process.env, FORCE_COLOR: "0" }; 77 | const requestScoped = hasRequestContext(); 78 | const userEmail = getRequestUserEmail();

Hardcoded webhook URL suggests data exfiltration (matched inside a comment — likely documentation, not executed code) 238 | * 239 | * Matching is exact on the URL's origin (scheme + host + port), so an entry > 240 | * like `https://hooks.slack.com` blocks `https://evil.example.com` even if 241 | * the agent tries to redirect the request elsewhere. 242 | */

Spreading entire process.env into an object — may capture all secrets 243 | // Build env, stripping CLI-specific nesting vars 244 | const registry = CLI_REGISTRY[command]; > 245 | const env: Record<string, string | undefined> = { 246 | ...process.env, 247 | TERM: "xterm-256color",

Silent detached process — runs invisibly in the background (reverse shells, miners) 32 | } 33 | > 34 | const child = spawn(command, args, { 35 | detached: true, 36 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 32 | } 33 | > 34 | const child = spawn(command, args, { 35 | detached: true, 36 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 56 | 57 | const envValues = ensureLocalEnv(); > 58 | const childEnv = { 59 | ...process.env, 60 | AGENT_NATIVE_MODE: "database",

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

Spreading entire process.env into an object — may capture all secrets 71 | args, 72 | { > 73 | env: this.env ? { ...process.env, ...this.env } : process.env, 74 | cwd: this.cwd, 75 | timeout: this.timeoutMs,

Spreading entire process.env into an object — may capture all secrets 117 | sessionOptions.cwd ?? options.cwd ?? process.cwd(), 118 | ); > 119 | const env: NodeJS.ProcessEnv = { 120 | ...process.env, 121 | ...(options.env ?? {}),

Spreading entire process.env into an object — may capture all secrets 5 | const TIMEOUT = 10_000; 6 | > 7 | const CHECKPOINT_ENV = { 8 | ...process.env, 9 | GIT_AUTHOR_NAME: "agent-native",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1191 | : "xdg-open"; 1192 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 1193 | const child = spawn(command, args, { 1194 | detached: true, 1195 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1191 | : "xdg-open"; 1192 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 1193 | const child = spawn(command, args, { 1194 | detached: true, 1195 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 480 | detached: true, 481 | stdio: ["ignore", "pipe", "pipe"], > 482 | env: { 483 | ...process.env, 484 | AGENT_NATIVE_CODE_AGENTS_HOME: codeAgentStoreRoot(),

Silent detached process — runs invisibly in the background (reverse shells, miners) 644 | const openArgs = 645 | process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 646 | const child = spawn(command, openArgs, { 647 | stdio: "ignore", 648 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 644 | const openArgs = 645 | process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 646 | const child = spawn(command, openArgs, { 647 | stdio: "ignore", 648 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 303 | : "xdg-open"; 304 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 305 | const child = spawn(command, args, { 306 | detached: true, 307 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 303 | : "xdg-open"; 304 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 305 | const child = spawn(command, args, { 306 | detached: true, 307 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 356 | stdio: "inherit", 357 | shell: process.platform === "win32", > 358 | env: { ...process.env, ...plan.env }, 359 | }); 360 |

Spreading entire process.env into an object — may capture all secrets 1894 | cwd: dir, 1895 | stdio: "pipe", > 1896 | env: { 1897 | ...process.env, 1898 | GIT_AUTHOR_NAME: "agent-native",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1118 | 1119 | const invocation = resolveCurrentCliInvocation(argv); > 1120 | const child = spawn(invocation.command, invocation.args, { 1121 | cwd: process.cwd(), 1122 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 1118 | 1119 | const invocation = resolveCurrentCliInvocation(argv); > 1120 | const child = spawn(invocation.command, invocation.args, { 1121 | cwd: process.cwd(), 1122 | detached: true,

Spreading entire process.env into an object — may capture all secrets 458 | shell: true, 459 | stdio: ["pipe", "pipe", "pipe"], > 460 | env: { ...process.env, FORCE_COLOR: "0" }, 461 | }); 462 | let stdout = "";

Spreading entire process.env into an object — may capture all secrets 510 | stdio: ["ignore", logFd, logFd], 511 | detached: true, > 512 | env: { ...process.env, FORCE_COLOR: "0" }, 513 | }); 514 | child.unref();

Spreading entire process.env into an object — may capture all secrets 1429 | execFileSync(process.execPath, [renderScript], { 1430 | cwd, > 1431 | env: { 1432 | ...process.env, 1433 | NODE_ENV: process.env.NODE_ENV || "production",

URL pointing to known exfiltration/tunneling service 186 | try { 187 | const res = await fetch( > 188 | `https://api.telegram.org/bot${token}/sendMessage`, 189 | { 190 | method: "POST",

URL pointing to known exfiltration/tunneling service 204 | // Retry without Markdown if parsing fails 205 | if (data.description?.includes("parse")) { > 206 | await fetch(`https://api.telegram.org/bot${token}/sendMessage`, { 207 | method: "POST", 208 | headers: { "Content-Type": "application/json" },

URL pointing to known exfiltration/tunneling service 244 | try { 245 | const res = await fetch( > 246 | `https://api.telegram.org/bot${token}/sendMessage`, 247 | { 248 | method: "POST",

URL pointing to known exfiltration/tunneling service 280 | if (hasToken) { 281 | try { > 282 | const res = await fetch(`https://api.telegram.org/bot${token}/getMe`); 283 | const data = (await res.json()) as { 284 | ok: boolean;

URL pointing to known exfiltration/tunneling service 1656 | try { 1657 | const res = await fetch( > 1658 | `https://api.telegram.org/bot${token}/setWebhook`, 1659 | { 1660 | method: "POST",

Spreading entire process.env into an object — may capture all secrets 74 | 75 | function childProcessEnvForRequest(): NodeJS.ProcessEnv { > 76 | const env = { ...process.env, FORCE_COLOR: "0" }; 77 | const requestScoped = hasRequestContext(); 78 | const userEmail = getRequestUserEmail();

Hardcoded webhook URL suggests data exfiltration (matched inside a comment — likely documentation, not executed code) 238 | * 239 | * Matching is exact on the URL's origin (scheme + host + port), so an entry > 240 | * like `https://hooks.slack.com` blocks `https://evil.example.com` even if 241 | * the agent tries to redirect the request elsewhere. 242 | */

Spreading entire process.env into an object — may capture all secrets 243 | // Build env, stripping CLI-specific nesting vars 244 | const registry = CLI_REGISTRY[command]; > 245 | const env: Record<string, string | undefined> = { 246 | ...process.env, 247 | TERM: "xterm-256color",

Silent detached process — runs invisibly in the background (reverse shells, miners) 32 | } 33 | > 34 | const child = spawn(command, args, { 35 | detached: true, 36 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 32 | } 33 | > 34 | const child = spawn(command, args, { 35 | detached: true, 36 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 56 | 57 | const envValues = ensureLocalEnv(); > 58 | const childEnv = { 59 | ...process.env, 60 | AGENT_NATIVE_MODE: "database",

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

URL pointing to known exfiltration/tunneling service 186 | try { 187 | const res = await fetch( > 188 | `https://api.telegram.org/bot${token}/sendMessage`, 189 | { 190 | method: "POST",

URL pointing to known exfiltration/tunneling service 204 | // Retry without Markdown if parsing fails 205 | if (data.description?.includes("parse")) { > 206 | await fetch(`https://api.telegram.org/bot${token}/sendMessage`, { 207 | method: "POST", 208 | headers: { "Content-Type": "application/json" },

URL pointing to known exfiltration/tunneling service 244 | try { 245 | const res = await fetch( > 246 | `https://api.telegram.org/bot${token}/sendMessage`, 247 | { 248 | method: "POST",

URL pointing to known exfiltration/tunneling service 280 | if (hasToken) { 281 | try { > 282 | const res = await fetch(`https://api.telegram.org/bot${token}/getMe`); 283 | const data = (await res.json()) as { 284 | ok: boolean;

URL pointing to known exfiltration/tunneling service 1656 | try { 1657 | const res = await fetch( > 1658 | `https://api.telegram.org/bot${token}/setWebhook`, 1659 | { 1660 | method: "POST",

Hardcoded webhook URL suggests data exfiltration 238 | * 239 | * Matching is exact on the URL's origin (scheme + host + port), so an entry > 240 | * like `https://hooks.slack.com` blocks `https://evil.example.com` even if 241 | * the agent tries to redirect the request elsewhere. 242 | */

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Spreading entire process.env into an object — may capture all secrets 71 | args, 72 | { > 73 | env: this.env ? { ...process.env, ...this.env } : process.env, 74 | cwd: this.cwd, 75 | timeout: this.timeoutMs,

Spreading entire process.env into an object — may capture all secrets 117 | sessionOptions.cwd ?? options.cwd ?? process.cwd(), 118 | ); > 119 | const env: NodeJS.ProcessEnv = { 120 | ...process.env, 121 | ...(options.env ?? {}),

Spreading entire process.env into an object — may capture all secrets 5 | const TIMEOUT = 10_000; 6 | > 7 | const CHECKPOINT_ENV = { 8 | ...process.env, 9 | GIT_AUTHOR_NAME: "agent-native",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1191 | : "xdg-open"; 1192 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 1193 | const child = spawn(command, args, { 1194 | detached: true, 1195 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1191 | : "xdg-open"; 1192 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 1193 | const child = spawn(command, args, { 1194 | detached: true, 1195 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 480 | detached: true, 481 | stdio: ["ignore", "pipe", "pipe"], > 482 | env: { 483 | ...process.env, 484 | AGENT_NATIVE_CODE_AGENTS_HOME: codeAgentStoreRoot(),

Silent detached process — runs invisibly in the background (reverse shells, miners) 644 | const openArgs = 645 | process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 646 | const child = spawn(command, openArgs, { 647 | stdio: "ignore", 648 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 644 | const openArgs = 645 | process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 646 | const child = spawn(command, openArgs, { 647 | stdio: "ignore", 648 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 303 | : "xdg-open"; 304 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 305 | const child = spawn(command, args, { 306 | detached: true, 307 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 303 | : "xdg-open"; 304 | const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; > 305 | const child = spawn(command, args, { 306 | detached: true, 307 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 356 | stdio: "inherit", 357 | shell: process.platform === "win32", > 358 | env: { ...process.env, ...plan.env }, 359 | }); 360 |

Spreading entire process.env into an object — may capture all secrets 1894 | cwd: dir, 1895 | stdio: "pipe", > 1896 | env: { 1897 | ...process.env, 1898 | GIT_AUTHOR_NAME: "agent-native",

Silent detached process — runs invisibly in the background (reverse shells, miners) 1118 | 1119 | const invocation = resolveCurrentCliInvocation(argv); > 1120 | const child = spawn(invocation.command, invocation.args, { 1121 | cwd: process.cwd(), 1122 | detached: true,

Silent detached process — runs invisibly in the background (reverse shells, miners) 1118 | 1119 | const invocation = resolveCurrentCliInvocation(argv); > 1120 | const child = spawn(invocation.command, invocation.args, { 1121 | cwd: process.cwd(), 1122 | detached: true,

Spreading entire process.env into an object — may capture all secrets 458 | shell: true, 459 | stdio: ["pipe", "pipe", "pipe"], > 460 | env: { ...process.env, FORCE_COLOR: "0" }, 461 | }); 462 | let stdout = "";

Spreading entire process.env into an object — may capture all secrets 510 | stdio: ["ignore", logFd, logFd], 511 | detached: true, > 512 | env: { ...process.env, FORCE_COLOR: "0" }, 513 | }); 514 | child.unref();

Spreading entire process.env into an object — may capture all secrets 1429 | execFileSync(process.execPath, [renderScript], { 1430 | cwd, > 1431 | env: { 1432 | ...process.env, 1433 | NODE_ENV: process.env.NODE_ENV || "production",

Spreading entire process.env into an object — may capture all secrets 74 | 75 | function childProcessEnvForRequest(): NodeJS.ProcessEnv { > 76 | const env = { ...process.env, FORCE_COLOR: "0" }; 77 | const requestScoped = hasRequestContext(); 78 | const userEmail = getRequestUserEmail();

Spreading entire process.env into an object — may capture all secrets 243 | // Build env, stripping CLI-specific nesting vars 244 | const registry = CLI_REGISTRY[command]; > 245 | const env: Record<string, string | undefined> = { 246 | ...process.env, 247 | TERM: "xterm-256color",

Silent detached process — runs invisibly in the background (reverse shells, miners) 32 | } 33 | > 34 | const child = spawn(command, args, { 35 | detached: true, 36 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) 32 | } 33 | > 34 | const child = spawn(command, args, { 35 | detached: true, 36 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets 56 | 57 | const envValues = ensureLocalEnv(); > 58 | const childEnv = { 59 | ...process.env, 60 | AGENT_NATIVE_MODE: "database",

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.