persona-ai-sdk@1.0.0

Analysis

persona-ai-sdk@1.0.0 is an AI character SDK that hides a remote-code loader inside heavily obfuscated modules wired into its public entry point. index.mjs imports personas.mjs, which imports "cssVarMap" from ./cache-warm.mjs; that file, plus sibling modules cache-sweep.mjs, build-cache.mjs and workspaces.js, are javascript-obfuscator output (thousands of _0x identifiers, a shuffled base64 string table, String.fromCharCode constant folding, and XOR decoders) performing no cache work at all. On first use of the persona cache, cache-warm.mjs runs an async loader that imports node:fs, node:path, node:os, node:url and node:child_process and calls a hidden entry function. build-cache.mjs then resolves a hex:IPv4:port token, fetches a script over raw HTTP (node:http POST/GET helpers with a 2.5s timeout), passes the returned body to (0, eval)(...), and re-launches that fetched script as a detached, unref'd node child process with windowsHide set and the installer's complete process.env passed through as its environment. cache-sweep.mjs performs the same detached spawn of a fetched script via process.execPath. The package also ships six platform-specific native addons, native/{win32,linux,darwin}/{x64,arm64}/cache-probe.node, built on the VMAware/node-vm-detect library: embedded strings include "isVM", "brand", "Hypervisor (Type 1)", "Hypervisor (Type 2)", "TPM", "MEASURED_BOOT" and paths under node-vm-detect/VMAware/src/vmaware.hpp, i.e. hypervisor/sandbox detection. cache-warm.mjs additionally walks parent directories reading package.json files and assembles the host project's dependency tree into a string. The second-stage payload is fetched at runtime, so its host and URL are not present in the published files; the delivery uses plain HTTP to a raw hex:IP:port token.