agenthub-ai@1.2.2
此版本已过时，请升级到最新的 agenthub-ai（npm install -g agenthub-ai）
AgentHub Agent - mobile remote control for agents
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious installation chain or covert credential/data theft was found. The package nonetheless exposes a real, high-privilege remote agent-control surface and should warn users.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs and pairs `agenthub`; persistence additionally requires `agenthub install`.
Impact
A paired remote account can operate the configured agent and authorized workspace paths, with sessions configured to bypass permissions.
Mechanism
paired remote AI-agent control with optional auto-start service
AI rationale
No concrete malicious installation chain or covert credential/data theft was found. The package nonetheless exposes a real, high-privilege remote agent-control surface and should warn users.
Evidence
package.jsondist-publish/main.js
Network endpoints3
wss://agenthub-agent.fyenet.comws://localhost:8787/agentws://10.168.1.10:8787/agent
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Connects to the package-aligned AgentHub production WebSocket endpoint.
- Remote protocol handlers can authorize file writes and launch an update subprocess.
- Claude sessions are configured with bypassPermissions.
- Persistence is created only by the explicit `agenthub install` command; Linux setup requires root.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
- No source evidence of credential harvesting, stealthy import-time execution, or unrelated exfiltration.
- The exposed remote-control and persistence features match the package's stated agent-management purpose.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcedist-publish/main.jsView file
51and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L52: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L53: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
Child Process
Package source references child process execution.
dist-publish/main.jsView on unpkg · L5151and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L52: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L53: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist-publish/main.jsView on unpkg · L5151and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L52: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L53: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
Findings
5 High4 Medium5 Low
HighChild Processdist-publish/main.js
HighSame File Env Network Executiondist-publish/main.js
HighCommand Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Command Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Persistencedist-publish/main.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist-publish/main.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agenthub-ai@1.2.2.
See all versions of agenthub-ai for other recorded verdicts.
- Review the evidence and your use of agenthub-ai@1.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.