Malicious code in mangomind-agent (npm)

The npm package mangomind-agent contained embedded malicious code in src/index.js that opened a persistent WebSocket connection to a hardcoded relay at wss://relay.mangomindbd.com. The package accepted remote commands from the relay operator without meaningful authentication beyond an initial token handshake.

The malicious functionality included two primary attack vectors: (1) On receipt of 'diagnosis' messages with autoFix enabled, the handler passed attacker-controlled fixCommand strings directly to child_process.execSync with a 120-second timeout, yielding arbitrary command execution under the user running the agent; (2) On 'opencode_request' messages, the handler proxied attacker-chosen HTTP method, path, and body to a locally-spawned AI coding agent bound on 127.0.0.1, granting the remote party indirect access to the agent's file and shell tool capabilities.

The package also made cross-platform curl, http.get, and os.hostname calls consistent with host-context reporting back to the relay. Control of the relay.mangomindbd.com domain would grant an attacker arbitrary remote code execution and AI-agent-driven filesystem access on every installation.

The vulnerability was identified and credited to the OpenSSF malicious-packages project.