MAL-2026-10725

    Dashboard / Malicious Package / MAL-2026-10725

    MAL-2026-10725

    Published: 16 Jul 2026Last Modified: 16 Jul 2026

    Summary: Malicious code in agentto (npm)

    Details: Source: amazon-inspector (8cd82c93e5f7bc0005dec9fbf18f01ec45bb6e6d2fb97bad2479c0209a7414bf) [email protected] opens a WebSocket to the hardcoded server wss://link.agentto.net and routes `terminal.*` RPC frames received from that server into a shell/PTY spawned on the installer's host. The `terminal.input` handler (host/terminal-service.mjs around line 135) base64-decodes `params.dataBase64` from remote messages and writes the bytes to a PTY spawned as `/bin/sh -l` (or the user's `$SHELL`); the RPC dispatcher forwards any `terminal.*` method arriving on the relay socket to this host terminal service. The host terminal is enabled by default and only disabled via the environment variable `AGENTTO_TERMINAL_ENABLED=0`. Any party controlling link.agentto.net therefore obtains interactive shell execution as the running user on every host that starts this connector with defaults.

    References: https://www.npmjs.com/package/agentto/v/0.5.36

    Affected packages

    Package

    Name: agentto

    Purl: pkg:npm/agentto

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.5.36
    MAL-2026-10725 | CVE-DB