Loading npm security reports…

@agent-link/agent@0.1.270: Malicious npm security report (Block) | LPM Firewall

registry / @agent-link/agent / 0.1.270

@agent-link/agent@0.1.270

AgentLink local agent CLI

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10705 confirms this npm version as malicious. The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` /...

Advisory

MAL-2026-10705

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @agent-link/agent (npm)

Details

The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` / `terminal_input` events from the WebSocket's `on('message')` handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a `ping`/`GET`/`POST`/`http.request` command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.

Decision reason

One or more suspicious static signals were detected.

Source & flagged code

5 flagged

dist/copilot.jsView file

Lines 1-30javascript

1/**

2 * Copilot CLI process driver for AgentLink.

3 *

4 * Parallel to claude.ts but simpler:

5 * - Each turn spawns a new `copilot --output-format json` process

6 * - Prompt is written to stdin to avoid command-line length limits

7 * - No persistent process, no control_request protocol

8 * - JSONL stdout parsed and emitted as backend_event messages

9 * - Session state stored at ~/.copilot/session-state/<id>/

10 */

11import { spawn, execFileSync } from 'child_process';

12import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/copilot.jsView on unpkg · L10

13import { readdirSync, readFileSync, writeFileSync, existsSync, rmSync, mkdirSync } from 'fs';

14import { dirname, join, resolve } from 'path';

15import { homedir, platform } from 'os';

16import { randomUUID } from 'crypto';

17import { processUserMessage } from './history-message-transform.js';

18import { copilotCapabilities } from './backends/types.js';

19import { CONFIG_DIR } from './config.js';

20import { getCleanEnv } from './sdk.js';

21import { getProvider, resolveProviderCommand } from './providers.js';

22import { FileCache } from './file-cache.js';

23// ── Module state ───────────────────────────────────────────────────────────

24const conversations = new Map();

25const sendFns = new Set();

26let globalModel = null;

27const MODEL_PATTERN = /^[a-zA-Z0-9._-]+$/;

28const CONTEXT_TIERS = new Set(['default', 'long_context']);

29const REASONING_EFFORTS = new Set(['none', 'low', 'medium', 'high', 'xhigh', 'max']);

30/** Heartbeat interval for turn liveness (15 seconds). */

Lines 170-210javascript

170function resolveCopilotPath() {

171 if (resolvedCopilotPath)

172 return resolvedCopilotPath;

173 const isWin = platform() === 'win32';

174 // Try where/which

dist/emergency-upgrade.jsView file

Lines 1-24javascript

1import { createHash } from 'crypto';

2import { mkdtempSync, rmSync, writeFileSync } from 'fs';

3import { tmpdir } from 'os';

4import { join, posix } from 'path';

dist/service.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { existsSync, mkdirSync, writeFileSync, unlinkSync } from 'fs';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service.jsView on unpkg · L1

3import { join, dirname, resolve } from 'path';

4

dist/cli.jsView file

Lines 721-761javascript

721 savedState = { ...wasRunning };

722 // Save config now while the old version is still current

723 savedConfig = loadConfig();

724 console.log(`Stopping agent (PID ${wasRunning.pid})...`);

725