MalwarePublished 7 Aug 2026

agenthub-ai (npm) · Malicious Code

Affects agenthub-aiSource GCVE Database

Malicious package : remove agenthub-ai and rotate any secrets on hosts that installed it.

Data as of 8 Aug 2026, 15:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13615

What to do

Remove agenthub-ai from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmagenthub-ai	Affected 0.20.1 – 0.20.4 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The agenthub-ai npm package runs a persistent daemon that connects to a hardcoded WebSocket server controlled by the package maintainer or potentially an attacker who compromises that server. This daemon can execute server-supplied commands with broad file system access and spawn subprocesses, enabling full host control. It also supports a remote update mechanism that can force the installation of new code versions. Additionally, the package redirects native bindings to a placeholder package, which could be replaced later with malicious payloads. The daemon activates only when the package's binary is run, not during installation or import.

Impact

Any party controlling the WebSocket server can execute arbitrary code with full host privileges on machines running the agenthub-ai daemon. This includes reading, writing, and searching files and spawning subprocesses with arbitrary commands. The remote update mechanism allows forced installation of new malicious code versions, escalating the risk of persistent compromise. The override of native bindings to a placeholder package introduces supply chain risk, as a malicious republish could affect all users of the package. This results in a high risk of full system compromise for users running the daemon.

Defensive guidance

Users should avoid running the agenthub-ai package binary to prevent the daemon from starting. Since the daemon only activates when the binary is executed, not on install or require, refraining from running the binary mitigates immediate risk. Monitor the package's official repository and vendor advisories for updates or patches. Consider removing the package from systems where it is not essential.

Summary

The agenthub-ai npm package versions 0.20.1, 0.20.2, 0.20.3, and 0.20.4 include a persistent daemon that opens a WebSocket connection to a hardcoded production endpoint (wss://agenthub-agent.fyenet.com). This connection allows the server to send commands that read, write, and search files on the host machine and spawn the local Claude Agent CLI with arbitrary prompts. The daemon's default permissions bypass restrictions, granting extensive control to the server operator or any party who compromises it. A documented 'update' action enables the server to stop the daemon, run 'npm install' to fetch the latest agenthub-ai version, and restart the daemon, effectively allowing forced remote code execution under the package's name. The package.json uses overrides to replace native subpackages with a stub package (agenthub-empty@1.0.0), which could be republished with malicious payloads, affecting all installers. The daemon only runs when the package's binary is executed, not during installation or when required as a module.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Aug 2026, 15:39 UTC

Technical details

References

Community reviews