Malicious code in agenthub-ai (npm)

The agenthub-ai npm package contained intentionally malicious code discovered by Amazon Inspector and credited to the OpenSSF. When the package binary was executed, it spawned a persistent daemon that opened a WebSocket connection to the hardcoded production endpoint wss://agenthub-agent.fyenet.com.

The daemon implemented remote command handlers that granted the server operator full control over the host machine, including the ability to read, write, and search files, and spawn the local Claude Agent CLI as a subprocess with server-supplied prompts. The package.json configured bypassPermissions as the default, reducing friction for these operations.

A documented update action allowed the remote server to stop the daemon, invoke npm install to fetch the latest agenthub-ai version, and restart it—effectively forcing all active installations to pull and execute new code under the attacker's control. Additionally, the package used npm overrides to substitute every @anthropic-ai/claude-agent-sdk-* platform-native subpackage with npm:agenthub-empty@1.0.0, redirecting upstream vendor bindings to a package under a different maintainer namespace. This created a secondary supply chain pivot: if the stub package were later republished with a payload, every agenthub-ai installer would automatically pull it.

The malicious daemon only activated when the package binary was explicitly run, not during npm install or require(), potentially evading some automated detection.