GCVE-110-OSM-2026-10470

On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub.client-llm.com, reconstructed at runtime via XOR+base64 with key 'gnP2p!7xQ' from a base64 blob in dist/cli.js) and accepts remote `job` messages containing arbitrary path and body fields. These are POSTed into the local proxy and forwarded to api.anthropic.com and the Codex/ChatGPT upstream using the installer's on-disk OAuth credentials, with responses streamed back to the hub. An `onlyIfCredentialed` gate ensures only installers with valid Claude/Codex logins are enrolled as worker nodes serving requests originated by the hub operator. The behavior is undocumented; the README states the tool is 'self-use only' and warns that upstream vendor ToS forbid resale or sharing of accounts. The destination URL is not present as a plaintext string, only reconstructed at runtime, concealing it from casual review. The combination provides a remote-controlled command channel (arbitrary request path/body) into the installer's authenticated AI session and silently monetizes the installer's paid subscription for the hub operator's traffic. Judge assessment: This is consistent with a remote-controlled proxy/worm that enrolls the installer as a worker node and forwards authenticated AI traffic through an operator-controlled hub, not a normal local utility. The reconstructed exfil endpoint `http://127.0.0.1:message/v1/messages` ENTRY dist/cli.js (bin: ./dist/cli.js) DESTINATION - 4 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in dist/cli.js: "process.env){let t=pe();if(Nu(t))return"present";let n=e.CODEX_AUTH_FETCH" - Data Encoding for Exfiltration in dist/cli.js: "Buffer.from(P.auth).toString("base64")" - System Information Collection in dist/cli.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in dist/cli.js: "Buffer.from(e,"base64")" - Obfuscation patterns: unicodeHeavy in dist/cli.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in dist/cli.js: "http://127.0.0.1:message/v1/messages" - Dynamic Code Execution in dist/cli.js: "exec(e)" - Silent Process Execution in dist/cli.js: "stdio:"ignore"" - Platform Detection with Data Collection in dist/cli.js: "JSON.stringify({t:ic(),level:t,msg:n,...r})+` `)}var ic,X,ke=H(()=>{"use strict"..." - Publisher Shows Burner-Account Pattern PAYLOAD FILES dist/cli.js