malicious-packages database. There is no coordinated-disclosure window (the maintainer is the attacker). codelake never stores raw payloads — only the detection rule, file:line, and IOCs.
@ikbal_fadilah_vanexa01/vanexa-agent — malicious npm package, independently detected and OSV-corroborated
@ikbal_fadilah_vanexa01/vanexa-agent is a malicious npm package that codelake Research independently detected during automated supply-chain scanning, corroborated by MAL-2026-13364 in OSV. The detection signal and affected versions are detailed below.
codelake's analysis classifies the detection signal as behaviour that decodes and executes a packed/obfuscated payload.
Affected version(s): 1.1.51, 1.1.53, 1.1.54, 1.1.55, 1.1.56, 1.1.57, 1.2.0, 1.3.19, 1.3.21, 1.3.23, 1.3.29, 1.3.3, 1.3.4, 1.3.40, 1.3.6.
codelake's per-ecosystem scanners flagged the specimen and the AI-triage judge classified it malicious (recorded signal: decode-exec payload in bundle, confidence 0.90).
This is an independent detection by codelake's own scanners and AI-triage pipeline; it is corroborated by MAL-2026-13364 in OSV (codelake was not necessarily the first public reporter for this record).
All analysis is performed at the indicator level on extracted source only — codelake never executes specimens and stores only the detection rule, indicators and analysis, never raw payloads.
Detected independently by codelake Research · automated per-ecosystem supply-chain scanning + AI-triage, verified at the indicator level on extracted source (no execution). Corroborated by MAL-2026-13364 in OSV. codelake stores only the detection rule, indicators and analysis, never raw payloads.