Malicious code in mangomind-agent (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6512bd1cea27977e679186d569d524555fdf0ed5ea9e4b965aa640b1ae8326cb) src/index.js opens a persistent WebSocket to a hardcoded default relay at wss://relay.mangomindbd.com and dispatches on message types received from that remote endpoint. On messages of type 'diagnosis' with autoFix set, the handler passes msg.fixCommand — a string chosen by whoever controls the relay — directly to child_process.execSync on the local machine (timeout 120000ms), yielding full-host command execution under the user running the agent. On messages of type 'opencode_request', the handler forwards attacker-chosen HTTP method, path, and body to a locally-spawned opencode AI coding agent bound on 127.0.0.1 and returns its response, giving the same remote party a proxied channel to drive that agent's file and shell tool access against the installer's workspace. The relay hostname mangomindbd.com is also referenced from https://api.mangomindbd.com in the same file, and the module makes cross-platform curl/http.get/os.hostname calls consistent with host-context reporting to the relay. The remote-execution paths are gated only by an initial token handshake with the relay operator, so any party in control of relay.mangomindbd.com holds arbitrary RCE and AI-agent-driven filesystem access on every host running this package.
AI Analysis
Technical Summary
The mangomind-agent npm package (versions 0.1.0 through 0.2.1, specifically listed) includes a backdoor that connects to wss://relay.mangomindbd.com. The package listens for messages from this relay and executes commands from the relay operator via child_process.execSync, allowing arbitrary command execution. It also proxies requests to a local AI coding agent, granting the relay operator filesystem and shell access. The only gate is a token handshake controlled by the relay operator, meaning full remote control is possible for anyone controlling the relay server. This is a malicious package rather than a typical vulnerability.
Potential Impact
Any host running the affected versions of mangomind-agent is subject to full remote code execution and arbitrary command execution by the operator of the remote relay server. This includes the ability to execute shell commands and interact with a local AI coding agent with filesystem access. The compromise is complete for the user context running the agent, posing a severe security risk including potential data theft, system manipulation, or further lateral movement.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the mangomind-agent package from their environments and avoid installing or running it. Since the malicious behavior is triggered by communication with a hardcoded remote relay, blocking network access to relay.mangomindbd.com may reduce risk but does not remove the malicious code. Monitor for presence of this package and replace it with trusted alternatives. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Malicious code in mangomind-agent (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6512bd1cea27977e679186d569d524555fdf0ed5ea9e4b965aa640b1ae8326cb) src/index.js opens a persistent WebSocket to a hardcoded default relay at wss://relay.mangomindbd.com and dispatches on message types received from that remote endpoint. On messages of type 'diagnosis' with autoFix set, the handler passes msg.fixCommand — a string chosen by whoever controls the relay — directly to child_process.execSync on the local machine (timeout 120000ms), yielding full-host command execution under the user running the agent. On messages of type 'opencode_request', the handler forwards attacker-chosen HTTP method, path, and body to a locally-spawned opencode AI coding agent bound on 127.0.0.1 and returns its response, giving the same remote party a proxied channel to drive that agent's file and shell tool access against the installer's workspace. The relay hostname mangomindbd.com is also referenced from https://api.mangomindbd.com in the same file, and the module makes cross-platform curl/http.get/os.hostname calls consistent with host-context reporting to the relay. The remote-execution paths are gated only by an initial token handshake with the relay operator, so any party in control of relay.mangomindbd.com holds arbitrary RCE and AI-agent-driven filesystem access on every host running this package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mangomind-agent npm package (versions 0.1.0 through 0.2.1, specifically listed) includes a backdoor that connects to wss://relay.mangomindbd.com. The package listens for messages from this relay and executes commands from the relay operator via child_process.execSync, allowing arbitrary command execution. It also proxies requests to a local AI coding agent, granting the relay operator filesystem and shell access. The only gate is a token handshake controlled by the relay operator, meaning full remote control is possible for anyone controlling the relay server. This is a malicious package rather than a typical vulnerability.
Potential Impact
Any host running the affected versions of mangomind-agent is subject to full remote code execution and arbitrary command execution by the operator of the remote relay server. This includes the ability to execute shell commands and interact with a local AI coding agent with filesystem access. The compromise is complete for the user context running the agent, posing a severe security risk including potential data theft, system manipulation, or further lateral movement.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the mangomind-agent package from their environments and avoid installing or running it. Since the malicious behavior is triggered by communication with a hardcoded remote relay, blocking network access to relay.mangomindbd.com may reduce risk but does not remove the malicious code. Monitor for presence of this package and replace it with trusted alternatives. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13611
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a75f706bf8831d53984e34d
Added to database: 08/07/2026, 15:17:26 UTC
Last enriched: 08/07/2026, 15:18:48 UTC
Last updated: 09/21/2026, 23:47:50 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.