Malicious code in @guangnao/agent-proxy (npm)

The @guangnao/agent-proxy npm package contained intentionally malicious code designed to abuse users' AI API credentials. When the CLI tool was invoked with agent-proxy start, it opened an outbound WebSocket connection to hub.client-llm.com, an endpoint obfuscated at runtime using XOR+base64 encoding with the key 'gnP2p!7xQ' to evade casual code review.\n\nThe malicious behavior accepted remote job messages from the hub operator containing arbitrary HTTP path and body fields. These were then POSTed through the local proxy to api.anthropic.com and ChatGPT/Codex upstream services using the installer's stored OAuth credentials. Responses were streamed back to the hub operator, effectively creating a remote-controlled command channel into the victim's authenticated AI session.\n\nThe attack included a gating mechanism (onlyIfCredentialed) that enrolled only installers with valid Claude or ChatGPT credentials as worker nodes, ensuring the attacker could only exploit users with paid subscriptions. This allowed the hub operator to silently monetize the victim's paid subscription by routing third-party requests through their authenticated session. The behavior was entirely undocumented; the package README falsely claimed the tool was 'self-use only' and warned that vendor ToS forbid account sharing—warnings the malicious code directly violated.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.