registry / @agent-link/agent / 0.1.324

@agent-link/agent@0.1.324

AgentLink local agent CLI

AI Security Review

scanned 9d ago · by lpm-firewall-ai

A global postinstall can update an already-adopted AgentLink runtime and refresh its package-owned launcher. The downloaded runtime is executed for self-checking and later selected by the launcher.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Global npm installation after the user has previously adopted the AgentLink version store.

Impact

A compromise of the allowed runtime publisher could execute a replacement AgentLink runtime in an already opted-in local agent installation.

Mechanism

Remote runtime download, staging, self-check execution, and AgentLink launcher update.

Rationale

This is a real first-party agent lifecycle and persistence capability with install-time remote runtime execution, but it is guarded by prior adoption and limited to AgentLink-owned state. Source inspection found no concrete malicious chain or foreign/broad AI-agent control-surface mutation.

Evidence

package.jsonscripts/install-bridge.cjsdist/install-bridge.jsdist/runtime-release.jsdist/version-stager.jsdist/launcher-manager.jsdist/service.js~/.agentlink/versions~/.agentlink/launcher/launcher.cjs

Network endpoints2

msclaude.ai/files/agent/runtime/wss://msclaude.ai

The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` / `terminal_input` events from the WebSocket's `on('message')` handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a `ping`/`GET`/`POST`/`http.request` command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.

@agent-link/agent@0.1.324

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code