Loading npm security reports…

@agent-link/agent@0.1.275: Malicious npm security report (Block) | LPM Firewall

registry / @agent-link/agent / 0.1.275

@agent-link/agent@0.1.275

AgentLink local agent CLI

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10705 confirms this npm version as malicious. The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` /...

Advisory

MAL-2026-10705

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @agent-link/agent (npm)

Details

The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` / `terminal_input` events from the WebSocket's `on('message')` handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a `ping`/`GET`/`POST`/`http.request` command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Source & flagged code

6 flagged · loading source

dist/copilot.jsView file

10*/ L11: import { spawn, execFileSync } from 'child_process'; L12: import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/copilot.jsView on unpkg · L10

190catch { L191: // where/which failed — try PowerShell on Windows L192: if (isWin) {

High

Shell

Package source references shell execution.

dist/copilot.jsView on unpkg · L190

dist/emergency-upgrade.jsView file

4import { join, posix } from 'path'; L5: import { gunzipSync } from 'zlib'; L6: export const EMERGENCY_MANIFEST_URL = 'https://msclaude.ai/files/agent/latest.json'; L7: const ALLOWED_ARTIFACT_ORIGIN = 'https://msclaude.ai'; ... L176: } L177: if (normalizedPath === 'package/package.json') { L178: if (packageIdentity) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/emergency-upgrade.jsView on unpkg · L4

dist/service.jsView file

1import { execSync } from 'child_process'; L2: import { existsSync, mkdirSync, writeFileSync, unlinkSync } from 'fs'; ... L48: } L49: return join(homedir(), '.config', 'systemd', 'user', `${SERVICE_NAME}.service`); L50: } ... L183: try { L184: execSync(`launchctl unload "${plistPath}" 2>/dev/null`); L185: } ... L215: function getStartupBatPath() { L216: const startupDir = join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup'); L217: return join(startupDir, `${SERVICE_NAME}.bat`); ... L264: export function isServiceInstalled() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service.jsView on unpkg · L1

dist/cli.jsView file

733else { L734: execSync(`npm install -g "@agent-link/agent@${targetVersion}"`, { stdio: 'inherit' }); L735: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L733

dist/connection.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agent-link/agent@0.1.270 matchedIdentity = npm:QGFnZW50LWxpbmsvYWdlbnQ:0.1.270 similarity = 0.918 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/connection.jsView on unpkg

Source & flagged code

6 flagged

dist/copilot.jsView file

Lines 1-30javascript

1/**

2 * Copilot CLI process driver for AgentLink.

3 *

4 * Parallel to claude.ts but simpler:

5 * - Each turn spawns a new `copilot --output-format json` process

6 * - Prompt is written to stdin to avoid command-line length limits

7 * - No persistent process, no control_request protocol

8 * - JSONL stdout parsed and emitted as backend_event messages

9 * - Session state stored at ~/.copilot/session-state/<id>/

10 */

11import { spawn, execFileSync } from 'child_process';

12import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/copilot.jsView on unpkg · L10

13import { readdirSync, readFileSync, writeFileSync, existsSync, rmSync, mkdirSync } from 'fs';

14import { dirname, join, resolve } from 'path';

15import { homedir, platform } from 'os';

16import { randomUUID } from 'crypto';

17import { processUserMessage } from './history-message-transform.js';

18import { copilotCapabilities } from './backends/types.js';

19import { CONFIG_DIR } from './config.js';

20import { getCleanEnv } from './sdk.js';

21import { getProvider, resolveProviderCommand } from './providers.js';

22import { FileCache } from './file-cache.js';

23// ── Module state ───────────────────────────────────────────────────────────

24const conversations = new Map();

25const sendFns = new Set();

26let globalModel = null;

27const MODEL_PATTERN = /^[a-zA-Z0-9._-]+$/;

28const CONTEXT_TIERS = new Set(['default', 'long_context']);

29const REASONING_EFFORTS = new Set(['none', 'low', 'medium', 'high', 'xhigh', 'max']);

30/** Heartbeat interval for turn liveness (15 seconds). */

Lines 170-210javascript

170function resolveCopilotPath() {

171 if (resolvedCopilotPath)

172 return resolvedCopilotPath;

173 const isWin = platform() === 'win32';

174 // Try where/which

dist/emergency-upgrade.jsView file

Lines 1-24javascript

1import { createHash } from 'crypto';

2import { mkdtempSync, rmSync, writeFileSync } from 'fs';

3import { tmpdir } from 'os';

4import { join, posix } from 'path';

dist/service.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { existsSync, mkdirSync, writeFileSync, unlinkSync } from 'fs';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service.jsView on unpkg · L1

3import { join, dirname, resolve } from 'path';

4

dist/cli.jsView file

Lines 713-753javascript

713 savedState = { ...wasRunning };

714 // Save config now while the old version is still current

715 savedConfig = loadConfig();

716 console.log(`Stopping agent (PID ${wasRunning.pid})...`);

717

dist/connection.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agent-link/agent@0.1.270 matchedIdentity = npm:QGFnZW50LWxpbmsvYWdlbnQ:0.1.270 similarity = 0.918 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/connection.jsView on unpkg