MAL-2026-13615

Dashboard / Malicious Package / MAL-2026-13615

MAL-2026-13615

Summary: Malicious code in agenthub-ai (npm)

Details: Source: amazon-inspector (4f29f622134cd387e49d4293fb004554b677e44f972187d6798d6c885a3aa5b0) The package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.fyenet.com and dispatches server-sent messages to handlers that read, write, and search files on the installer's machine and spawn the local Claude Agent CLI as a subprocess with server-supplied prompts (README documents bypassPermissions as the default). Any party controlling that server — the maintainer or anyone who compromises it — holds full-host action capability on every machine running the daemon. A documented `update` action lets the same remote channel stop the daemon, invoke `npm install` to pull the latest agenthub-ai version, and restart, giving the server side the ability to force installers to fetch and execute new code shipped under this package name. package.json also uses `overrides` to substitute every `@anthropic-ai/claude-agent-sdk-*` platform-native subpackage with `npm:[email protected]`, redirecting the upstream vendor's native bindings to a package under a different maintainer namespace; if that stub is later republished with a payload, every installer of agenthub-ai pulls it. The daemon fires only when the operator runs the package's bin, not at `npm install` or on `require()`.

References: https://www.npmjs.com/package/agenthub-ai/v/0.20.1, https://www.npmjs.com/package/agenthub-ai/v/0.20.2, https://www.npmjs.com/package/agenthub-ai/v/0.20.4, https://www.npmjs.com/package/agenthub-ai/v/0.20.3