MalwarePublished 16 Jul 2026Updated 6 Aug 2026

@agent-link/agent (npm) · Malicious Code

Affects @agent-link/agentSource GCVE Database

Malicious package : remove @agent-link/agent and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10705

What to do

Remove @agent-link/agent from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@agent-link/agent	Affected 0.1.269 – 0.1.325 41 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @agent-link/agent npm package contains malicious code that connects to a hardcoded WebSocket relay at wss://msclaude.ai. This relay can send commands that are executed interactively on the host system via a locally spawned shell, enabling remote command execution. The package also fetches and installs updates from the same unverified origin, allowing an attacker controlling the relay to replace the package with malicious versions. The publisher identity and origin of the relay are unclear and unverified, increasing the risk of supply chain compromise. Multiple specific versions of the package are affected.

Impact

An attacker controlling the WebSocket relay or possessing a valid session URL can execute arbitrary commands on the host system running the vulnerable @agent-link/agent package. This includes interactive shell access and the ability to perform HTTP requests or other operations via included scripts. Furthermore, the attacker can push malicious package updates by controlling the update manifest and tarball served from the relay domain, enabling persistent compromise and further malicious actions. This represents a critical supply chain compromise risk.

Defensive guidance

Users should immediately discontinue use of the @agent-link/agent package versions listed as affected. Due to the malicious nature of the package and unverified publisher identity, it is recommended to remove the package from all environments and avoid installing it until a trustworthy, verified version or alternative is available. Monitor for any unauthorized command execution or unexpected network connections to wss://msclaude.ai.

Summary

The @agent-link/agent npm package establishes a WebSocket connection to a hardcoded relay endpoint (wss://msclaude.ai) and forwards messages received from this relay directly into a locally spawned pseudo-terminal (PTY) shell process. This design allows whoever controls the relay or holds a session URL to execute arbitrary commands interactively on the host system running the agent. Additionally, the package's emergency upgrade mechanism downloads replacement package tarballs from the same origin, verifying only manifest data served by that origin, effectively allowing the relay operator to push signed-by-manifest malicious updates. The package's publisher provenance is unclear, with inconsistent GitHub references and an unverified relay domain, indicating a high risk of malicious supply chain activity.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:33 UTC

Technical details

References

Community reviews