npm JavaScript analyzed 26.6.29

nyxora

v26.6.29

npm

Your Personal Web3 Assistant

maintainer: nyxora_agent
license: MIT
first seen: 2026-06-18
last seen: 2026-06-25
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools

transport stdio · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

tools

get_wallet_address
request_transaction

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v26.6.29 · analyzer v28 · 2d ago

danger signals6

suspicious endpoint api.telegram.org expected for this server's purpose package/dist/launcher.js :75 await fetch(`https://api.telegram.org/bot${tgToken}/sendMessage`, {
suspicious endpoint api.telegram.org expected for this server's purpose package/dist/packages/core/src/gateway/telegram.js :169 const fileLink = `https://api.telegram.org/file/bot${token}/${file.file_path}`;
suspicious endpoint api.telegram.org expected for this server's purpose package/launcher.ts :80 await fetch(`https://api.telegram.org/bot${tgToken}/sendMessage`, {
suspicious endpoint api.telegram.org expected for this server's purpose package/packages/core/src/gateway/telegram.ts :187 const fileLink = `https://api.telegram.org/file/bot${token}/${file.file_path}`;
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets package/dist/packages/core/src/gateway/googleAuthModule.js :20 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets package/packages/core/src/gateway/googleAuthModule.ts :12 'https://www.googleapis.com/auth/spreadsheets',

code evidence v26.6.29 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 253

filesystem 83

fs package/bin/nyxora.mjs :5 import fs from 'fs';
fs package/dist/launcher.js :11 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/agent/reasoning.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/agent/transactionManager.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/agent/updateIdentity.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/agent/updateProfile.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/config/defiConfigManager.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/config/marketConfigManager.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/config/parser.js :15 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/config/paths.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/chat.js :9 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/cli.js :42 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/doctor.js :7 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/googleAuthModule.js :12 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/server.js :29 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/setup.js :10 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/telegram.js :24 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/gateway/tracker.js :40 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/memory/episodic.js :9 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/memory/logger.js :7 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/memory/promotionEngine.js :7 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/plugin/registry.js :42 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/plugins/SystemPluginInstallerPlugin.js :7 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/skills/analyzeDocument.js :41 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/skills/audioTranscribe.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/skills/editFile.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/skills/generateExcel.js :10 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/skills/readFile.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/skills/updateSecurityPolicy.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/system/skills/writeFile.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/utils/dynamicTokenUpdater.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/utils/skillManager.js :10 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/utils/state.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/utils/userWhitelistManager.js :10 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/web3/aggregator/providerRegistry.js :41 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/web3/skills/createMarketWatchAgent.js :9 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/web3/skills/installDefiProvider.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/core/src/web3/utils/vaultClient.js :8 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/policy/src/server.js :11 const fs_1 = __importDefault(require("fs"));
fs package/dist/packages/signer/src/server.js :43 const fs_1 = __importDefault(require("fs"));
fs package/launcher.ts :7 import fs from 'fs';
fs package/packages/core/src/agent/osAgent.ts :1 import fs from 'fs';
fs package/packages/core/src/agent/reasoning.ts :1 import fs from 'fs';
fs package/packages/core/src/agent/transactionManager.ts :2 import fs from 'fs';
fs package/packages/core/src/agent/updateIdentity.ts :1 import fs from 'fs';
fs package/packages/core/src/agent/updateProfile.ts :1 import fs from 'fs';
fs package/packages/core/src/agent/web3Agent.ts :1 import fs from 'fs';
fs package/packages/core/src/config/defiConfigManager.ts :1 import fs from 'fs';
fs package/packages/core/src/config/marketConfigManager.ts :1 import fs from 'fs';
fs package/packages/core/src/config/parser.ts :1 import fs from 'fs';
fs package/packages/core/src/config/paths.ts :1 import fs from 'fs';
fs package/packages/core/src/gateway/chat.ts :3 import fs from 'fs';
fs package/packages/core/src/gateway/cli.ts :6 import fs from 'fs';
fs package/packages/core/src/gateway/doctor.ts :1 import fs from 'fs';
fs package/packages/core/src/gateway/googleAuthModule.ts :1 import fs from 'fs';
fs package/packages/core/src/gateway/server.ts :28 import fs from 'fs';
fs package/packages/core/src/gateway/setup.ts :4 import fs from 'fs';
fs package/packages/core/src/gateway/telegram.ts :17 import fs from 'fs';
fs package/packages/core/src/gateway/tracker.ts :1 import fs from 'fs';
fs package/packages/core/src/memory/episodic.ts :3 import fs from 'fs';
fs package/packages/core/src/memory/logger.ts :1 import fs from 'fs';
fs package/packages/core/src/memory/promotionEngine.ts :1 import fs from 'fs';
fs package/packages/core/src/plugin/registry.ts :2 import fs from 'fs';
fs package/packages/core/src/system/plugins/SystemPluginInstallerPlugin.ts :2 import fs from 'fs';
fs package/packages/core/src/system/skills/analyzeDocument.ts :1 import fs from 'fs';
fs package/packages/core/src/system/skills/audioTranscribe.ts :1 import fs from 'fs';
fs package/packages/core/src/system/skills/editFile.ts :1 import fs from 'fs';
fs package/packages/core/src/system/skills/generateExcel.ts :3 import fs from 'fs';
fs package/packages/core/src/system/skills/readFile.ts :1 import fs from 'fs';
fs package/packages/core/src/system/skills/updateSecurityPolicy.ts :1 import fs from 'fs';
fs package/packages/core/src/system/skills/writeFile.ts :1 import fs from 'fs';
fs package/packages/core/src/utils/dynamicTokenUpdater.ts :1 import fs from 'fs';
fs package/packages/core/src/utils/skillManager.ts :1 import fs from 'fs';
fs package/packages/core/src/utils/state.ts :1 import fs from 'fs';
fs package/packages/core/src/utils/userWhitelistManager.ts :1 import fs from 'fs';
fs package/packages/core/src/web3/aggregator/providerRegistry.ts :3 import fs from 'fs';
fs package/packages/core/src/web3/skills/createMarketWatchAgent.ts :3 import fs from 'fs';
fs package/packages/core/src/web3/skills/installDefiProvider.ts :1 import fs from 'fs';
fs package/packages/core/src/web3/utils/vaultClient.ts :1 import fs from 'fs';
fs package/packages/mcp-server/dist/server.js :12 const fs_1 = __importDefault(require("fs"));
fs package/packages/mcp-server/src/server.ts :8 import fs from 'fs';
fs package/packages/policy/src/server.ts :7 import fs from 'fs';
fs package/packages/signer/src/server.ts :6 import fs from 'fs';

shell / exec 11

shell package/bin/nyxora.mjs :3 import { spawn } from 'child_process';
shell package/dist/launcher.js :9 const child_process_1 = require("child_process");
shell package/dist/packages/core/src/config/parser.js :28 const { execSync } = require('child_process');
shell package/dist/packages/core/src/system/skills/browseWeb.js :5 const child_process_1 = require("child_process");
shell package/dist/packages/core/src/system/skills/executeShell.js :5 const child_process_1 = require("child_process");
shell package/dist/packages/core/src/system/skills/gitManager.js :5 const child_process_1 = require("child_process");
shell package/launcher.ts :5 import { spawn } from 'child_process';
shell package/packages/core/src/config/parser.ts :13 const { execSync } = require('child_process');
shell package/packages/core/src/system/skills/browseWeb.ts :1 import { execSync } from 'child_process';
shell package/packages/core/src/system/skills/executeShell.ts :1 import { exec } from 'child_process';
shell package/packages/core/src/system/skills/gitManager.ts :1 import { exec } from 'child_process';

network 29

net package/bin/nyxora.mjs :334 const res = await fetch('http://localhost:3000/api/status/unlock', {
net package/dist/launcher.js :75 await fetch(`https://api.telegram.org/bot${tgToken}/sendMessage`, {
net package/dist/packages/core/src/agent/llmProvider.js :222 const response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${request.model}:generateContent?key=${this.apiKey}`, {
net package/dist/packages/core/src/gateway/chat.js :51 const response = await fetch('http://localhost:3000/api/chat', {
net package/dist/packages/core/src/gateway/doctor.js :8 const net_1 = __importDefault(require("net"));
net package/dist/packages/core/src/gateway/googleAuthModule.js :66 const res = await fetch('https://oauth2.googleapis.com/token', {
net package/dist/packages/core/src/gateway/telegram.js :175 const res = await fetch(fileLink);
net package/dist/packages/core/src/system/skills/googleWorkspace.js :19 const listRes = await fetch(`https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=${maxResults}&q=in:inbox`, {
net package/dist/packages/core/src/system/skills/searchWeb.js :11 const res = await fetch(url, { headers: { 'User-Agent': 'Mozilla/5.0 (compatible; NyxoraBot/1.0)' }, signal: AbortSignal.timeout(5000) });
net package/dist/packages/core/src/utils/dynamicTokenUpdater.js :37 const res = await fetch(url);
net package/dist/packages/core/src/utils/httpClient.js :43 const res = await fetch(url, {
net package/dist/packages/core/src/web3/utils/vaultClient.js :12 const http_1 = __importDefault(require("http"));
net package/dist/packages/policy/src/server.js :13 const http_1 = __importDefault(require("http"));
net package/launcher.ts :80 await fetch(`https://api.telegram.org/bot${tgToken}/sendMessage`, {
net package/packages/core/src/agent/llmProvider.ts :248 const response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${request.model}:generateContent?key=${this.apiKey}`, {
net package/packages/core/src/gateway/WebSocketManager.ts :2 import http from 'http';
net package/packages/core/src/gateway/chat.ts :52 const response = await fetch('http://localhost:3000/api/chat', {
net package/packages/core/src/gateway/doctor.ts :3 import net from 'net';
net package/packages/core/src/gateway/googleAuthModule.ts :70 const res = await fetch('https://oauth2.googleapis.com/token', {
net package/packages/core/src/gateway/server.ts :20 import http from 'http';
net package/packages/core/src/gateway/telegram.ts :195 const res = await fetch(fileLink);
net package/packages/core/src/system/skills/googleWorkspace.ts :13 const listRes = await fetch(`https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=${maxResults}&q=in:inbox`, {
net package/packages/core/src/system/skills/searchWeb.ts :8 const res = await fetch(url, { headers: { 'User-Agent': 'Mozilla/5.0 (compatible; NyxoraBot/1.0)' }, signal: AbortSignal.timeout(5000) });
net package/packages/core/src/utils/dynamicTokenUpdater.ts :38 const res = await fetch(url);
net package/packages/core/src/utils/httpClient.ts :56 const res = await fetch(url, {
net package/packages/core/src/web3/utils/vaultClient.ts :5 import http from 'http';
net package/packages/mcp-server/dist/server.js :10 const http_1 = __importDefault(require("http"));
net package/packages/mcp-server/src/server.ts :6 import http from 'http';
net package/packages/policy/src/server.ts :9 import http from 'http';

secrets 2

secrets package/dist/packages/core/src/config/parser.js :25 let masterKeyRaw = process.env.NYXORA_MASTER_KEY;
secrets package/packages/core/src/config/parser.ts :10 let masterKeyRaw = process.env.NYXORA_MASTER_KEY;

tool registrations 2

get_wallet_address package/packages/mcp-server/dist/server.js :81
request_transaction package/packages/mcp-server/dist/server.js :96

install hooks 1

prepublishOnly package/package.json :40 npm run build

declared dependencies 48

@modelcontextprotocol/sdk@^1.5.0
@anthropic-ai/sdk@^0.105.0
@clack/prompts@^1.4.0
@grammyjs/runner@^2.0.3
@grammyjs/transformer-throttler@^1.2.1
@inquirer/search@^4.2.1
@mozilla/readability@^0.6.0
@msgpack/msgpack@^3.1.3
@napi-rs/keyring@^1.3.0
@notionhq/client@^5.22.0
chokidar@^5.0.0
cors@^2.8.6
croner@^10.0.1
csv-parse@^6.2.1
dotenv@^17.4.2
duck-duck-scrape@^2.2.7
express@^5.2.1
express-rate-limit@^7.5.0
grammy@^1.44.0
helmet@^8.0.0
isolated-vm@^6.1.2
jsonwebtoken@^9.0.2
linkedom@^0.18.12
mammoth@^1.6.0
multer@^2.2.0
open@^11.0.0
openai@^6.39.0
pdf-parse@^2.4.5
picocolors@^1.1.1
playwright@^1.60.0
proper-lockfile@^4.1.2
read-excel-file@^9.2.0
ts-node@^10.9.2
twitter-api-v2@^1.29.0
typescript@^6.0.3
viem@^2.51.0
write-excel-file@^4.1.1
ws@^8.21.0
yaml@^2.9.0
zod@^3.25.76
@types/jsonwebtoken@^9.0.5
@types/node@^25.9.1
@types/ws@^8.5.10
concurrently@^10.0.3
oxc-minify@^0.135.0
oxlint@^1.70.0
vitepress@^2.0.0-alpha.17
vitest@^4.1.9