The @funny-booth/agent-core npm package includes obfuscated runtime files that expose a malicious control point (MCP) server. This server fetches JSON data from a hardcoded portal (prompt-injection-tool-portal.vercel.app) and executes the 'install_command' field directly via child_process.exec(), allowing arbitrary shell command execution with the installer's privileges. The launcher component fetches additional MCP entries from the same portal and runs attacker-named npm packages with injected decrypted vault secrets in the environment, enabling secret exfiltration and further compromise. It also silently self-updates by globally installing the latest package version on every run. Furthermore, it spawns a local Claude CLI with portal-supplied prompts, creating a prompt-injection vector into the user's Claude agent session. The obfuscation and hardcoded endpoints indicate deliberate concealment of these remote execution and secret exfiltration channels.

An attacker controlling the portal can execute arbitrary shell commands on any system installing or running this package, with the privileges of the user running the installer or launcher. They can also execute arbitrary npm packages with access to decrypted local secrets, potentially leading to full system compromise and secret leakage. The silent auto-update mechanism allows the attacker to push new malicious code at any time. The prompt-injection channel into the Claude agent may allow manipulation of local AI interactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should immediately stop using the @funny-booth/agent-core package and remove it from their environments. Avoid running or installing this package, and audit systems for any presence of it. Monitor for any unexpected network connections to the hardcoded portal and suspicious npm package executions. Consider rebuilding affected environments after removal to ensure no persistent backdoors remain.