agenthub-ai@1.3.6
AgentHub Agent - mobile remote control for agents
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource establishes a real high-privilege remote agent-control capability and a remotely initiated update path. It is not concrete malware under the install-time policy because startup, pairing, and autostart installation are user-invoked.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `agenthub`, completes local pairing, and an authorized App/Server sends commands.
Impact
Remote controller can operate agent sessions with bypassed permissions and request workdir file operations; it can trigger a global package update.
Mechanism
Paired WebSocket remote-agent control and self-update relay.
AI rationale
Source establishes a real high-privilege remote agent-control capability and a remotely initiated update path. It is not concrete malware under the install-time policy because startup, pairing, and autostart installation are user-invoked.
Evidence
package.jsondist-publish/main.jsREADME_EN.md
Network endpoints3
ws://localhost:8787/agentws://10.168.1.10:8787/agentwss://agenthub-agent.fyenet.com
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Remote control relay receives App commands and drives an installed agent CLI.
- Default bypassPermissions plus remote workdir file read/write creates a high-impact control surface.
- A remote AgentUpdate action spawns its update command, which performs global npm installation.
Evidence against
- No npm preinstall/install/postinstall hook; entrypoint is a user-invoked bin.
- Autostart is documented as the explicit `agenthub install` command and removable by `uninstall`.
- Pairing requires a code displayed locally before a token is persisted.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcedist-publish/main.jsView file
49and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
Child Process
Package source references child process execution.
dist-publish/main.jsView on unpkg · L4949and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist-publish/main.jsView on unpkg · L4949and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
Findings
5 High4 Medium5 Low
HighChild Processdist-publish/main.js
HighSame File Env Network Executiondist-publish/main.js
HighCommand Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Command Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Persistencedist-publish/main.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist-publish/main.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agenthub-ai@1.3.6.
See all versions of agenthub-ai for other recorded verdicts.
- Review the evidence and your use of agenthub-ai@1.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.