registry / Malware / agenthub-ai

agenthub-ai

此版本已过时，请升级到最新的 agenthub-ai（npm install -g agenthub-ai）

AgentHub Agent - mobile remote control for agents

This report shows the evidence for agenthub-ai@0.20.3. 3 of 22 known versions are blocked or flagged. The newest version, 1.7.0, is flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13615 confirms this npm version as malicious.

Advisory

MAL-2026-13615

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in agenthub-ai (npm)

Details

The package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.fyenet.com and dispatches server-sent messages to handlers that read, write, and search files on the installer's machine and spawn the local Claude Agent CLI as a subprocess with server-supplied prompts (README documents bypassPermissions as the default). Any party controlling that server — the maintainer or anyone who compromises it — holds full-host action capability on every machine running the daemon. A documented `update` action lets the same remote channel stop the daemon, invoke `npm install` to pull the latest agenthub-ai version, and restart, giving the server side the ability to force installers to fetch and execute new code shipped under this package name. package.json also uses `overrides` to substitute every `@anthropic-ai/claude-agent-sdk-*` platform-native subpackage with `npm:agenthub-empty@1.0.0`, redirecting the upstream vendor's native bindings to a package under a different maintainer namespace; if that stub is later republished with a payload, every installer of agenthub-ai pulls it. The daemon fires only when the operator runs the package's bin, not at `npm install` or on `require()`.

References

OpenSSF/OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

This is a documented but high-impact remote agent-control capability, not evidence of covert install-time malware. The lack of lifecycle execution and guarded persistence makes a block unwarranted.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs agenthub after pairing; remote server sends supported actions; user runs or confirms install.

Impact

A compromised paired account/server could control the configured agent and access or modify local files.

Mechanism

paired remote-control daemon with unrestricted file RPC and permission-bypassing agent sessions

AI rationale

This is a documented but high-impact remote agent-control capability, not evidence of covert install-time malware. The lack of lifecycle execution and guarded persistence makes a block unwarranted.

Evidence

package.jsonREADME.mddist-publish/main.js~/.agenthub/agent-token-<kind>.json~/.claude/projects/etc/systemd/system/agenthub.service/Library/LaunchDaemons/com.agenthub.agenthub.plist%PROGRAMDATA%/AgentHub/daemon-env.json

Network endpoints4

wss://agenthub-agent.fyenet.comws://localhost:8787/agentws://10.168.1.10:8787/agent

Independent scan evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for AI warning decision

CLI opens persistent WebSocket to AgentHub server.
Remote actions read/write arbitrary supplied paths.
Sessions run Claude with bypassPermissions.
Explicit install registers OS auto-start service.
Remote agent.update invokes npm global install.

Evidence against

package.json has no install/postinstall hook.
Persistence is only via explicit install or interactive confirmation.
No hidden payload, eval, or credential-harvesting flow found.
Network endpoint and remote-control purpose are documented in README.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 99.3 KB of source, external domains: claude.ai

Source & flagged code

7 flagged

dist-publish/main.jsView file

52After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),g=d.slice(0,-1);this.buffers.set(e,d.at(-1)??"");let p=null,b=null,w=null,x=0;for(let h of g){let S=h.trim();if(S){x++;try{let _=JSON.parse(S),ct=this.classifyLine(_,e);ct&&(p=c...

High

Child Process

Package source references child process execution.

dist-publish/main.jsView on unpkg · L52

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-publish/main.jsView on unpkg · L52

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-publish/main.jsView on unpkg · L52

52Trigger-reachable command-output exfiltration chain: manifest.main -> dist-publish/main.js L52: After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),g=d.slice(0,-1);this.buffers.set(e,d.at(-1)??"");let p=null,b=null,w=null,x=0;for(let h of g){let S=h.trim();if(S){x++;try{let _=JSON.parse(S),ct=this.classifyLine(_,e);ct&&(p=c...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist-publish/main.jsView on unpkg · L52

1Trigger-reachable persistence chain: manifest.main -> dist-publish/main.js L1: #!/usr/bin/env node L2: var Ps=Object.defineProperty;var I=(s,e,t)=>()=>{if(t)throw t[0];try{return s&&(e=s(s=0)),e}catch(r){throw t=[r],r}};var ut=(s,e)=>{for(var t in e)Ps(s,t,{get:e[t],enumerable:!0})}... L3: ... L52: After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),g=d.slice(0,-1);this.buffers.set(e,d.at(-1)??"");let p=null,b=null,w=null,x=0;for(let h of g){let S=h.trim();if(S){x++;try{let _=JSON.parse(S),ct=this.classifyLine(_,e);ct&&(p=c... L55: `);i>0&&c.shift();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist-publish/main.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-publish/main.jsView on unpkg

1#!/usr/bin/env node L2: var Ps=Object.defineProperty;var I=(s,e,t)=>()=>{if(t)throw t[0];try{return s&&(e=s(s=0)),e}catch(r){throw t=[r],r}};var ut=(s,e)=>{for(var t in e)Ps(s,t,{get:e[t],enumerable:!0})}... L3: ... L52: After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),g=d.slice(0,-1);this.buffers.set(e,d.at(-1)??"");let p=null,b=null,w=null,x=0;for(let h of g){let S=h.trim();if(S){x++;try{let _=JSON.parse(S),ct=this.classifyLine(_,e);ct&&(p=c... L55: `);i>0&&c.shift();for(let d=c.length-1;d>=0;d--){let g=c[d];if(!g)continue;let p=g.match(/"cw

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-publish/main.jsView on unpkg · L1

Source & flagged code

7 flagged · loading source

dist-publish/main.jsView file

High

Child Process

Package source references child process execution.

dist-publish/main.jsView on unpkg · L52

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-publish/main.jsView on unpkg · L52

Findings

6 High4 Medium5 Low

HighChild Processdist-publish/main.js

HighSame File Env Network Executiondist-publish/main.js

HighCommand Output Exfiltrationdist-publish/main.js

HighTrigger Reachable Command Output Exfiltrationdist-publish/main.js

HighTrigger Reachable Persistencedist-publish/main.js

HighSemantic Analysis Limiteddist-publish/main.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist-publish/main.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to agenthub-ai@0.20.3.

The versions list below shows the verdict for each recorded version.

Avoid installing agenthub-ai@0.20.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-07 17:19:40.160Z (UTC).

Source advisory published: 2026-08-07 16:34:12.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

22 known versions

1.7.0latestSuspiciousAgent extension lifecycle riskWarnPublishedAug 23, 2026, 1:25 AM 1.6.2Clean—AllowPublishedAug 22, 2026, 9:02 AM 1.4.1SuspiciousAgent extension lifecycle riskWarnPublishedAug 20, 2026, 2:25 PM 1.3.6SuspiciousAI-agent capability abuseWarnPublishedAug 18, 2026, 7:01 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code