The @agent-link/agent npm package establishes a WebSocket connection to a hardcoded relay endpoint (wss://msclaude.ai) and forwards messages received from this relay directly into a locally spawned pseudo-terminal (PTY) shell process. This design allows whoever controls the relay or holds a session URL to execute arbitrary commands interactively on the host system running the agent. Additionally, the package's emergency upgrade mechanism downloads replacement package tarballs from the same origin, verifying only manifest data served by that origin, effectively allowing the relay operator to push signed-by-manifest malicious updates. The package's publisher provenance is unclear, with inconsistent GitHub references and an unverified relay domain, indicating a high risk of malicious supply chain activity.

An attacker controlling the WebSocket relay or possessing a valid session URL can execute arbitrary commands on the host system running the vulnerable @agent-link/agent package. This includes interactive shell access and the ability to perform HTTP requests or other operations via included scripts. Furthermore, the attacker can push malicious package updates by controlling the update manifest and tarball served from the relay domain, enabling persistent compromise and further malicious actions. This represents a critical supply chain compromise risk.

No official patch or remediation is currently documented. Users should immediately discontinue use of the @agent-link/agent package versions listed as affected. Due to the malicious nature of the package and unverified publisher identity, it is recommended to remove the package from all environments and avoid installing it until a trustworthy, verified version or alternative is available. Monitor for any unauthorized command execution or unexpected network connections to wss://msclaude.ai. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.