⌘ + K

MAL-2026-10705

Dashboard / Malicious Package / MAL-2026-10705

MAL-2026-10705

Published: 16 Jul 2026Last Modified: 6 Aug 2026

Summary: Malicious code in @agent-link/agent (npm)

Details: Source: amazon-inspector (a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912) The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` / `terminal_input` events from the WebSocket's `on('message')` handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a `ping`/`GET`/`POST`/`http.request` command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.

Affected packages

Package

Name: @agent-link/agent

Purl: pkg:npm/%40agent-link/agent

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

0.1.269

0.1.325

0.1.319

0.1.285

0.1.280

0.1.272

0.1.310

0.1.293

0.1.283

0.1.299

0.1.279

0.1.308

0.1.294

0.1.281

0.1.287

0.1.320

0.1.323

0.1.270

0.1.303

0.1.316

0.1.322

0.1.277

0.1.278

0.1.284

0.1.311

0.1.296

0.1.324

0.1.275

0.1.318

0.1.274

0.1.312

0.1.298

0.1.302

0.1.292

0.1.282

0.1.304

0.1.314

0.1.273

0.1.271

0.1.289

0.1.307