OpenSSF/OSV advisory MAL-2026-10725 confirms this npm version as malicious. agentto@0.5.36 opens a WebSocket to the hardcoded server wss://link.agentto.net and routes `terminal.*` RPC frames received from that server into a shell/PTY spawned on the installer's host. The `terminal.input` handler (host/terminal-service.mjs around line 135) base64-decodes `params.dataBase64` from remote messages and writes the bytes to a PTY spawned as `/bin/sh -l` (or the user's `$SHELL`); the RPC dispatcher...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in agentto (npm)
Details
agentto@0.5.36 opens a WebSocket to the hardcoded server wss://link.agentto.net and routes `terminal.*` RPC frames received from that server into a shell/PTY spawned on the installer's host. The `terminal.input` handler (host/terminal-service.mjs around line 135) base64-decodes `params.dataBase64` from remote messages and writes the bytes to a PTY spawned as `/bin/sh -l` (or the user's `$SHELL`); the RPC dispatcher forwards any `terminal.*` method arriving on the relay socket to this host terminal service. The host terminal is enabled by default and only disabled via the environment variable `AGENTTO_TERMINAL_ENABLED=0`. Any party controlling link.agentto.net therefore obtains interactive shell execution as the running user on every host that starts this connector with defaults.
Decision reason
OpenSSF Malicious Packages via OSV confirms agentto@0.5.36 as malicious (MAL-2026-10725): Malicious code in agentto (npm)