agenthub-ai@1.4.1

AgentHub Agent - mobile remote control for agents

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a real high-impact remote AI-agent and persistence surface, warranting a warning. Static source inspection found no concrete malicious install-time or covert attack chain.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `agenthub` and pairs it; persistence requires `agenthub install`.

Impact

A paired remote account can direct an AI CLI with broad local workdir capabilities.

Mechanism

Paired remote AI-agent control, optional service persistence, and self-update.

AI rationale

The package has a real high-impact remote AI-agent and persistence surface, warranting a warning. Static source inspection found no concrete malicious install-time or covert attack chain.

Evidence

dist-publish/main.jspackage.jsonREADME_EN.md

Network endpoints1

wss://agenthub-agent.fyenet.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Resident remote-control agent receives app commands and streams agent tool events.
It launches the Claude agent SDK with bypassPermissions.
It supports auto-start persistence and remote-triggered self-update.

Evidence against

No preinstall, install, or postinstall lifecycle hook; only prepublishOnly is declared.
Persistence is exposed as the explicit `agenthub install` command.
No source evidence of secret harvesting, covert exfiltration, or foreign AI-agent configuration mutation.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 150 KB of source, external domains: claude.ai

Source & flagged code

6 flagged

dist-publish/main.jsView file

49and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr... L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...

High

Child Process

Package source references child process execution.

dist-publish/main.jsView on unpkg · L49

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-publish/main.jsView on unpkg · L49

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-publish/main.jsView on unpkg · L49

49Trigger-reachable command-output exfiltration chain: manifest.main -> dist-publish/main.js L49: and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr... L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist-publish/main.jsView on unpkg · L49

1Trigger-reachable persistence chain: manifest.main -> dist-publish/main.js L1: #!/usr/bin/env node L2: var Bi=Object.create;var Ct=Object.defineProperty;var qi=Object.getOwnPropertyDescriptor;var Ni=Object.getOwnPropertyNames;var Oi=Object.getPrototypeOf,$i=Object.prototype.hasOwnPr... L3: ... L49: and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr... L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch... L52: `);i>0&&c.shift();let l=""

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist-publish/main.jsView on unpkg · L1

1#!/usr/bin/env node L2: var Bi=Object.create;var Ct=Object.defineProperty;var qi=Object.getOwnPropertyDescriptor;var Ni=Object.getOwnPropertyNames;var Oi=Object.getPrototypeOf,$i=Object.prototype.hasOwnPr... L3: ... L49: and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr... L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch... L52: `);i>0&&c.shift();let l="",u=0;for(let g=c.length-1;g>=0;g--){let m=c[g];if(m&&!(!m.includes('"type":

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-publish/main.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

dist-publish/main.jsView file

High

Child Process

Package source references child process execution.

dist-publish/main.jsView on unpkg · L49

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-publish/main.jsView on unpkg · L49

Findings

5 High4 Medium5 Low

HighChild Processdist-publish/main.js

HighSame File Env Network Executiondist-publish/main.js

HighCommand Output Exfiltrationdist-publish/main.js

HighTrigger Reachable Command Output Exfiltrationdist-publish/main.js

HighTrigger Reachable Persistencedist-publish/main.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist-publish/main.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to agenthub-ai@1.4.1.

See all versions of agenthub-ai for other recorded verdicts.

Review the evidence and your use of agenthub-ai@1.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-20 14:29:25.373Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.