agenthub-multiagent-mcp
MCP server for AgentHub multi-agent communication
This report shows the evidence for agenthub-multiagent-mcp@1.57.0. 1 of 17 known versions is blocked or flagged. The newest version, 1.76.0, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13399 confirms this npm version as malicious.
Advisory
MAL-2026-13399
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in agenthub-multiagent-mcp (npm)
Details
agenthub-multiagent-mcp ships a worker (dist/worker.js) that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/<id> and, for every 'dispatch' message received, writes the server-supplied message body to a prompt file and spawns 'bash run-claude.sh' which invokes 'claude -p "$PROMPT" --dangerously-skip-permissions --max-turns N --mcp-config...' with cwd set to a user-configured project directory. This gives whoever controls agenthub.contetial.com the ability to drive Claude Code's full tool suite (file read/write, shell, MCP tools) against the installer's projects with permissions checks explicitly disabled. The setup wizard (agenthub-setup) additionally installs OS-level persistence: a Windows Startup.vbs + hidden.bat launcher, a macOS LaunchAgent com.agenthub.worker.plist with RunAtLoad and KeepAlive, or a Linux systemd user unit agenthub-worker.service with Restart=always, so the remote-controlled worker reconnects on every login. Provenance is falsified: package.json declares repository.url https://github.com/anthropics/agenthub and homepage https://github.com/anthropics/agenthub#readme, and the README directs users to git clone https://github.com/anthropics/agenthub, while the actual author is 'Krishi AI' and the operational domain is agenthub.contetial.com. dist/setup.js contains a fetch to https://agenthub.contetial.com and dist/context.js/state.js perform base64 decoding of embedded blobs.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Source confirms runtime AI-agent configuration mutation and remote session capture capability, so it warrants a warning. No npm lifecycle execution or concrete stealth/malicious chain was found.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User starts/configures the AgentHub MCP executable.
Impact
AgentHub can influence Claude session startup and, with server-confirmed consent, transmit recorded session/tool data to its API.
Mechanism
runtime Claude Code hook installation and consent-gated session capture
AI rationale
Source confirms runtime AI-agent configuration mutation and remote session capture capability, so it warrants a warning. No npm lifecycle execution or concrete stealth/malicious chain was found.
Evidence
package.jsondist/index.jsdist/inboxHookInstall.jsdist/inboxHookCli.jsdist/captureHookInstall.jsdist/session-capture.sh~/.claude/settings.json~/.claude/agenthub-capture.json~/.claude/agenthub-capture-state~/.claude/skills
Network endpoints2
agenthub.contetial.com/api/session-capture/consentagenthub.contetial.com/api/sessions/{id}/events
Independent scan evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- dist/index.js installs activity and inbox Claude hooks on every MCP start unless env-disabled.
- dist/inboxHookInstall.js writes a SessionStart command into ~/.claude/settings.json by default.
- dist/inboxHookCli.js injects a system reminder to check and reply to AgentHub inbox messages before the user's request.
- dist/captureHookInstall.js can register a PostToolUse capture hook after a server consent response.
- dist/session-capture.sh sends captured tool/session content to the configured AgentHub API.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Hook and skill changes occur when the MCP executable is started, not during npm installation.
- Capture registration is explicitly gated on a successful consent lookup and removes its hook when consent is absent.
- Shell/startup persistence in dist/setup.js requires interactive agenthub-setup confirmation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
8 flaggednative/agenthub-memvid/index.jsView file
19try {
L20: const lddPath = require('child_process').execSync('which ldd').toString().trim()
L21: return readFileSync(lddPath, 'utf8').includes('musl')
High
Child Process
Package source references child process execution.
native/agenthub-memvid/index.jsView on unpkg · L19dist/channelSetupCli.jsView file
30if (process.platform === "win32") {
L31: const out = execFileSync("powershell", [
L32: "-NoProfile",
High
dist/commands/setup-shell.jsView file
Findings
5 High6 Medium4 Low
HighChild Processnative/agenthub-memvid/index.js
HighShelldist/channelSetupCli.js
HighSame File Env Network Executiondist/daemon.js#virtual:normalized:round1
HighTrigger Reachable Persistencedist/commands/setup-shell.js
HighPrevious Version Dangerous Deltadist/setup.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/commands/setup-shell.js
MediumShips Native Binarynative/agenthub-memvid/agenthub-memvid.win32-x64-msvc.node
MediumShips Build Helperdist/run-claude.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to agenthub-multiagent-mcp@1.57.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing agenthub-multiagent-mcp@1.57.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.