The agenthub-multiagent-mcp npm package (version 1.57.0) includes a worker script that connects to wss://agenthub.contetial.com/ws/workers/<id>. Upon receiving 'dispatch' messages, it writes the message body to a prompt file and executes a shell script that runs the 'claude' tool with permissions checks explicitly disabled. This enables the remote server to fully control the installed environment, including file read/write and shell command execution. The setup wizard installs OS-level persistence via startup scripts on Windows, LaunchAgents on macOS, and systemd user units on Linux, ensuring the worker reconnects on every login. The package misrepresents its provenance by declaring a GitHub repository and homepage unrelated to the actual author and control domain. Additional code performs base64 decoding of embedded blobs and fetches data from the malicious domain.

An attacker controlling agenthub.contetial.com can remotely execute arbitrary commands with elevated privileges on the victim's system where the package is installed. This includes full access to the user's project files and the ability to run shell commands without permission checks. The installed persistence mechanisms ensure continued remote access after system restarts, significantly increasing the risk of long-term compromise and data exfiltration or manipulation.

No official patch or fix is currently available for this malicious package version. Users should immediately uninstall agenthub-multiagent-mcp version 1.57.0 and remove any persistence mechanisms installed by the package (Windows Startup.vbs and hidden.bat, macOS LaunchAgent com.agenthub.worker.plist, Linux systemd user unit agenthub-worker.service). Avoid installing packages from untrusted sources and verify package provenance before use. Monitor for any suspicious activity related to this package and consider restoring affected systems from clean backups.