Suspicious npm Package @vibetonomy/agent-linux-x64 Execution
This detects command lines that install, download, or run an npm package called @vibetonomy/agent-linux-x64. The name is built to look like a legitimate agent runtime binary, a common trick used to trick people into installing something malicious under a trusted-sounding name.
How the attack works
An attacker publishes an npm package whose name imitates a real 'Vibetonomy agent' Linux x64 distribution. A victim, believing they are installing or running the legitimate agent runtime, types or scripts a command that names this package directly. The rule watches for that command line appearing on a system. It only sees the process command itself — it does not see whether npm actually resolved and downloaded the package, what the package did once running, or any network callback afterward.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3f1e9c2a-6b7d-4a1f-9c3e-8d2b5a7f1e64
- Severity
- Medium
Why it matters
If real, this pattern lets an attacker get a victim to run an unvetted, attacker-controlled binary on their machine under the guise of a trusted agent tool, potentially leading to code execution and further compromise. There is no confirmed payload or CVE behind this specific package name — it is flagged only because the naming matches a known impersonation pattern.
What you can do
- →Check whether @vibetonomy/agent-linux-x64 is genuinely published by the vendor you expect, using the official Vibetonomy documentation or repository, not just the npm registry listing.
- →If found in a dependency tree or lockfile, treat it as suspect until confirmed legitimate; do not run it.
- →Review shell history and CI/CD logs for install or execute commands referencing this package name to determine if it actually ran.
- →Restrict which registries and package sources your build systems can pull from, and require review of new dependencies before they are installed.
Known benign look-alikes
- Security researchers or SOC analysts grepping/catting package-lock.json, yarn.lock, pnpm-lock.yaml, or an SBOM to audit whether this package name is present anywhere in the dependency tree
- npm/pnpm/yarn metadata queries (npm view, npm info, npm audit, npm ls, npm why) run during dependency review that reference the package name without installing or executing it
- Remediation/removal commands (npm uninstall, npm rm, pnpm remove, yarn remove) that reference the package while cleaning up a suspected compromise
- CI/CD security scanners or SCA tools whose own command line embeds the package name as a known-bad string for detection/blocklist purposes