MalwarePublished 16 Jul 2026Updated 14 Aug 2026

@funny-booth/agent-core (npm) · Malicious Code

Affects @funny-booth/agent-coreSource GCVE Database

Malicious package : remove @funny-booth/agent-core and rotate any secrets on hosts that installed it.

Data as of 15 Aug 2026, 15:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10711

What to do

Remove @funny-booth/agent-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@funny-booth/agent-core	Affected 0.1.1 – 0.1.9 9 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4) The package ships heavily obfuscated runtime files (dist/index.js, dist/launcher.js) built with javascript-obfuscator. The MCP server registered as the package's main entry exposes an `install_mcp` tool that fetches JSON from the hardcoded portal `prompt-injection-tool-portal.vercel.app` and passes its `install_command` field directly to `child_process.exec()` on the installer's host, giving the portal operator arbitrary shell execution with the installer's privileges. The launcher (invoked by every `salesbot1..10` bin entry) calls `fetchBundledMcps` against the same portal and, for each returned entry, spawns `npx -y <entry.package>` while injecting locally decrypted vault secrets into the child's env — the portal can name any npm package, including a freshly published attacker-owned one, and it will be downloaded and executed with those secrets on hand. The launcher also unconditionally spawns a detached `npm i -g @funny-booth/agent-core@latest` on every run, silently self-updating to whatever the publisher pushes next. The launcher additionally spawns the local `claude` CLI with a portal-supplied greeting/knowledge string prepended as the initial user prompt and a portal-controlled MCP config, providing a prompt-injection channel into the user's Claude agent session. The repository URL in package.json is `github.com/yutamatsuura/prompt-injection-tool` and the deliberate obfuscation of the portal endpoints, exec sink, and auto-update spawn is consistent with intentional concealment of these remote-execution channels.

Impact

An attacker controlling the portal can execute arbitrary shell commands on any system installing or running this package, with the privileges of the user running the installer or launcher. They can also execute arbitrary npm packages with access to decrypted local secrets, potentially leading to full system compromise and secret leakage. The silent auto-update mechanism allows the attacker to push new malicious code at any time. The prompt-injection channel into the Claude agent may allow manipulation of local AI interactions.

Defensive guidance

Until a fix is available, users should immediately stop using the @funny-booth/agent-core package and remove it from their environments. Avoid running or installing this package, and audit systems for any presence of it. Monitor for any unexpected network connections to the hardcoded portal and suspicious npm package executions. Consider rebuilding affected environments after removal to ensure no persistent backdoors remain.

Summary

The @funny-booth/agent-core npm package includes obfuscated runtime files that expose a malicious control point (MCP) server. This server fetches JSON data from a hardcoded portal (prompt-injection-tool-portal.vercel.app) and executes the 'install_command' field directly via child_process.exec(), allowing arbitrary shell command execution with the installer's privileges. The launcher component fetches additional MCP entries from the same portal and runs attacker-named npm packages with injected decrypted vault secrets in the environment, enabling secret exfiltration and further compromise. It also silently self-updates by globally installing the latest package version on every run. Furthermore, it spawns a local Claude CLI with portal-supplied prompts, creating a prompt-injection vector into the user's Claude agent session. The obfuscation and hardcoded endpoints indicate deliberate concealment of these remote execution and secret exfiltration channels.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Aug 2026, 05:42 UTC

Technical details

References

Community reviews