The malicious code in @guangnao/agent-proxy (npm) versions =1.2.1, =1.4.0, and =1.4.2 activates on invocation of 'agent-proxy start'. It establishes an outbound WebSocket connection to an obfuscated endpoint (hub.client-llm.com), reconstructed at runtime to evade detection. Through this channel, the attacker can send remote 'job' messages containing arbitrary HTTP request paths and bodies, which the local proxy forwards to AI service endpoints (api.anthropic.com and Codex/ChatGPT) using the installer's OAuth credentials stored on disk. Responses are streamed back to the attacker's hub. An 'onlyIfCredentialed' gate ensures only users with valid AI service logins are exploited. This creates a remote-controlled command channel that silently monetizes the installer's paid AI subscription without their knowledge. The package's README warns against sharing accounts, but this malicious behavior is undocumented and concealed.

Attackers gain unauthorized remote control over the installer's authenticated AI sessions, allowing them to send arbitrary requests through the installer's paid AI subscription accounts. This results in unauthorized use and monetization of the installer's subscription, potential data leakage through proxied requests, and violation of service terms. The installer's system is effectively turned into a worker node for the attacker's AI traffic without consent.

No official patch or remediation is currently documented. Users should immediately discontinue use of the affected versions (=1.2.1, =1.4.0, =1.4.2) of @guangnao/agent-proxy. Review and remove the package from systems where it is installed. Monitor for any unauthorized outbound WebSocket connections to suspicious endpoints such as hub.client-llm.com. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.