Loading npm security reports…

@ai-support-agent/cli@0.4.2: Malicious npm security report | LPM Firewall

registry / @ai-support-agent/cli / 0.4.2

@ai-support-agent/cli@0.4.2

AI Support Agent CLI client

OSV Malicious Advisory

scanned 10d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10707 confirms this npm version as malicious. When `ai-support-agent start` is invoked, the CLI subscribes to a remote AppSync/WebSocket channel at api.ai-support-agent.com and dispatches server-delivered messages into local execution sinks. `execute_command` messages are passed to `spawn(shellCmd, ['-c', command])` in shell-executor.js; `terminal-ws` `stdin` frames are base64-decoded and written into a node-pty session (terminal-websocket.js `handleStdin`:...

Advisory

MAL-2026-10707

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @ai-support-agent/cli (npm)

Details

When `ai-support-agent start` is invoked, the CLI subscribes to a remote AppSync/WebSocket channel at api.ai-support-agent.com and dispatches server-delivered messages into local execution sinks. `execute_command` messages are passed to `spawn(shellCmd, ['-c', command])` in shell-executor.js; `terminal-ws` `stdin` frames are base64-decoded and written into a node-pty session (terminal-websocket.js `handleStdin`: `Buffer.from(msg.data,'base64').toString('utf-8'); session.write(decoded)`); additional handlers cover file_read/write/delete, process_kill, ssh_exec, server_setup_exec, reboot, and update. Whoever controls the vendor server — or anyone who obtains a valid agent token — has full shell-level control of the host running the agent. Related components include dist/vscode/vscode-server.js and dist/browser/browser-local-server.js (local HTTP endpoints and ping-based reachability probes) and dist/cli/service/{darwin,linux}-service.js (installs the agent as a persistent system service that modifies PATH), which extend and persist that control surface.

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory PACKAGE

Source & flagged code

8 flagged · loading source

ansible/roles/database/tasks/main.ymlView file

85patternName = generic_password severity = medium line = 85 matchedText = password... }}"

Medium

Secret Pattern

Package contains a possible secret pattern.

ansible/roles/database/tasks/main.ymlView on unpkg · L85

89patternName = generic_password severity = medium line = 89 matchedText = login_pa... }}"

Medium

Secret Pattern

Hardcoded password in ansible/roles/database/tasks/main.yml

ansible/roles/database/tasks/main.ymlView on unpkg · L89

119patternName = generic_password severity = medium line = 119 matchedText = password... }}"

Medium

Secret Pattern

Hardcoded password in ansible/roles/database/tasks/main.yml

ansible/roles/database/tasks/main.ymlView on unpkg · L119

dist/ws-reconnect.jsView file

3exports.attemptReconnect = attemptReconnect; L4: const logger_1 = require("./logger"); L5: const retry_strategy_1 = require("./retry-strategy");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ws-reconnect.jsView on unpkg · L3

dist/terminal/terminal-session.jsView file

40Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/agent-runner.js -> dist/terminal/terminal-session.js L40: const path = __importStar(require("path")); L41: const child_process_1 = require("child_process"); L42: const constants_1 = require("../constants"); ... L73: * 直接チェックする。Docker コンテナ内の Node.js プロセスは shell init を経由せず L74: * 起動するため、process.env.PATH がインタラクティブシェルの PATH と異なり L75: * spawnSync がバイナリを見つけられないことがある。 ... L102: * L103: * API サーバーが base64 エンコードされた PEM 秘密鍵をこの変数名で送ってくる。 L104: * TerminalSession はこれを検出してファイルに書き出し、GIT_SSH_COMMAND を設定する。 ... L124: * (clear grace timer + remove from map). It is kept separate from the public L125: * `exitCallback` so that a later `onExit()` registration by the websocket L126: * handler (which sends the 'exit' frame) does NOT overw

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/terminal/terminal-session.jsView on unpkg · L40

40const path = __importStar(require("path")); L41: const child_process_1 = require("child_process"); L42: const constants_1 = require("../constants"); ... L73: * 直接チェックする。Docker コンテナ内の Node.js プロセスは shell init を経由せず L74: * 起動するため、process.env.PATH がインタラクティブシェルの PATH と異なり L75: * spawnSync がバイナリを見つけられないことがある。 ... L102: * L103: * API サーバーが base64 エンコードされた PEM 秘密鍵をこの変数名で送ってくる。 L104: * TerminalSession はこれを検出してファイルに書き出し、GIT_SSH_COMMAND を設定する。 ... L124: * (clear grace timer + remove from map). It is kept separate from the public L125: * `exitCallback` so that a later `onExit()` registration by the websocket L126: * handler (which sends the 'exit' frame) does NOT overwrite the manager's

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/terminal/terminal-session.jsView on unpkg · L40

docker/bashrc-extra.shView file

•path = docker/bashrc-extra.sh kind = build_helper sizeBytes = 1069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/bashrc-extra.shView on unpkg

dist/browser/playwright-subprocess-executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ai-support-agent/cli@0.3.0 matchedIdentity = npm:QGFpLXN1cHBvcnQtYWdlbnQvY2xp:0.3.0 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser/playwright-subprocess-executor.jsView on unpkg

Source & flagged code

8 flagged

ansible/roles/database/tasks/main.ymlView file

Lines 65-122yaml

65 when: (db_type | default('')) == 'mysql' and db_root_password is defined

66

67# `check_implicit_admin: true` + the explicit `login_user`/`login_password`

68# fallback make this task idempotent across re-runs. On a fresh MySQL

69# install, root@localhost authenticates via the `auth_socket` plugin (no

70# password) over the unix socket — the "implicit admin" connection

71# `check_implicit_admin` tries first. Setting `password` here switches

72# root@localhost to password auth, so a *second* run can no longer connect

73# as the implicit admin; `check_implicit_admin` then falls back to

74# connecting as `login_user`/`login_password` (the same, now-current,

75# `db_root_password`), which succeeds and is a no-op since the password

76# already matches. Without this, a second run would fail outright once the

77# implicit-admin connection stops working. This mirrors the "Handle multiple

78# non-idempotent password changed states" example in the upstream

79# community.mysql.mysql_user documentation (ansible.mysql.mysql_user shares

80# the same module interface).

81- name: "database : Set MySQL root password"

82 ansible.mysql.mysql_user:

83 name: root

84 host: localhost

85 password: "{{ db_root_password }}"

Medium

Secret Pattern

Package contains a possible secret pattern.

ansible/roles/database/tasks/main.ymlView on unpkg · L85

86 login_unix_socket: /var/run/mysqld/mysqld.sock

87 check_implicit_admin: true

88 login_user: root

89 login_password: "{{ db_root_password }}"

Medium

Secret Pattern

Hardcoded password in ansible/roles/database/tasks/main.yml

ansible/roles/database/tasks/main.ymlView on unpkg · L89

90 when: (db_type | default('')) == 'mysql' and db_root_password is defined

91 no_log: true

92

93- name: "database : Install PostgreSQL server"

94 ansible.builtin.apt:

95 name:

96 - postgresql

97 state: present

98 update_cache: true

99 when: (db_type | default('')) == 'postgresql'

100

101- name: "database : Enable and start PostgreSQL"

102 ansible.builtin.service:

103 name: postgresql

104 state: started

105 enabled: true

106 when: (db_type | default('')) == 'postgresql'

107

108- name: "database : Install psycopg2 (required by community.postgresql.postgresql_user)"

109 ansible.builtin.apt:

110 name: python3-psycopg2

111 state: present

112 update_cache: true

113 when: (db_type | default('')) == 'postgresql' and db_root_password is defined

114

115- name: "database : Set PostgreSQL postgres user password"

116 become_user: postgres

117 community.postgresql.postgresql_user:

118 name: postgres

119 password: "{{ db_root_password }}"

Medium

Secret Pattern

Hardcoded password in ansible/roles/database/tasks/main.yml

ansible/roles/database/tasks/main.ymlView on unpkg · L119

120 when: (db_type | default('')) == 'postgresql' and db_root_password is defined

121 no_log: true

122

dist/ws-reconnect.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.attemptReconnect = attemptReconnect;

4const logger_1 = require("./logger"

dist/terminal/terminal-session.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.

docker/bashrc-extra.shView file

•path = docker/bashrc-extra.sh kind = build_helper sizeBytes = 1069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/bashrc-extra.shView on unpkg

dist/browser/playwright-subprocess-executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ai-support-agent/cli@0.3.0 matchedIdentity = npm:QGFpLXN1cHBvcnQtYWdlbnQvY2xp:0.3.0 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser/playwright-subprocess-executor.jsView on unpkg