The @agenthub-ai/agent package runs a daemon that opens a WebSocket connection to wss://agenthub-agent.fyenet.com. The daemon treats incoming messages as control commands executed on the host. It forwards MessageSend actions as user prompts to a Claude Code SDK session with 'bypassPermissions', allowing remote control of Bash and Edit tools without user approval, resulting in full remote code execution. The daemon also exposes FileTree, FileRead, FileWrite, and FileSearch actions without path restrictions, enabling enumeration of drives, arbitrary file reads (up to 20MB), and arbitrary file writes. An AgentUpdate action allows spawning a detached process that updates the package from the npm registry, enabling persistent code replacement controlled by the remote server or publishing account. This results in arbitrary shell execution, filesystem manipulation, and persistent malicious code on the installer's machine.

An attacker controlling the remote WebSocket server can execute arbitrary shell commands on the victim's machine, read and write arbitrary files without restriction, and update the malicious daemon code at will. This compromises the confidentiality, integrity, and availability of the affected system, allowing full remote control and persistent compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should uninstall the @agenthub-ai/agent package versions 0.5.1 and 0.9.2 and avoid installing or running this package. Monitor for any updates or advisories from the package maintainers or npm regarding remediation.