Malicious code in agenthub-multiagent-mcp (npm)

The npm package agenthub-multiagent-mcp ships a malicious worker (dist/worker.js) that connects to a hardcoded WebSocket server at wss://agenthub.contetial.com/ws/workers/. Upon receiving dispatch messages from the attacker-controlled server, the worker writes the message body to a prompt file and executes 'bash run-claude.sh', which invokes Claude with the --dangerously-skip-permissions flag, giving the remote attacker full access to Claude Code's tool suite (file read/write, shell, MCP tools) against the installer's projects.\n\nThe setup wizard (agenthub-setup) installs OS-level persistence mechanisms: on Windows, a Startup.vbs + hidden.bat launcher; on macOS, a LaunchAgent (com.agenthub.worker.plist) with RunAtLoad and KeepAlive; on Linux, a systemd user unit (agenthub-worker.service) with Restart=always. This ensures the malicious worker reconnects automatically on every system login.\n\nProvenance is falsified throughout: package.json declares the repository and homepage as https://github.com/anthropics/agenthub (implying Anthropic authorship), the README directs users to clone that same URL, yet the actual author is listed as 'Krishi AI' and the operational domain is agenthub.contetial.com. The setup.js file contains additional suspicious network activity.\n\nThis incident was identified by Amazon Inspector and reported via GitHub Security Advisory GHSA-gr2g-rx6h-9jh5.