MalwarePublished 7 Aug 2026

mangomind-agent (npm) · Malicious Code

Affects mangomind-agentSource GCVE Database

Malicious package : remove mangomind-agent and rotate any secrets on hosts that installed it.

Data as of 8 Aug 2026, 14:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13611

What to do

Remove mangomind-agent from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmmangomind-agent	Affected 0.1.0 – 0.2.1 12 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6512bd1cea27977e679186d569d524555fdf0ed5ea9e4b965aa640b1ae8326cb) src/index.js opens a persistent WebSocket to a hardcoded default relay at wss://relay.mangomindbd.com and dispatches on message types received from that remote endpoint. On messages of type 'diagnosis' with autoFix set, the handler passes msg.fixCommand — a string chosen by whoever controls the relay — directly to child_process.execSync on the local machine (timeout 120000ms), yielding full-host command execution under the user running the agent. On messages of type 'opencode_request', the handler forwards attacker-chosen HTTP method, path, and body to a locally-spawned opencode AI coding agent bound on 127.0.0.1 and returns its response, giving the same remote party a proxied channel to drive that agent's file and shell tool access against the installer's workspace. The relay hostname mangomindbd.com is also referenced from https://api.mangomindbd.com in the same file, and the module makes cross-platform curl/http.get/os.hostname calls consistent with host-context reporting to the relay. The remote-execution paths are gated only by an initial token handshake with the relay operator, so any party in control of relay.mangomindbd.com holds arbitrary RCE and AI-agent-driven filesystem access on every host running this package.

Impact

Any host running the affected versions of mangomind-agent is subject to full remote code execution and arbitrary command execution by the operator of the remote relay server. This includes the ability to execute shell commands and interact with a local AI coding agent with filesystem access. The compromise is complete for the user context running the agent, posing a severe security risk including potential data theft, system manipulation, or further lateral movement.

Defensive guidance

Users should immediately remove the mangomind-agent package from their environments and avoid installing or running it. Since the malicious behavior is triggered by communication with a hardcoded remote relay, blocking network access to relay.mangomindbd.com may reduce risk but does not remove the malicious code. Monitor for presence of this package and replace it with trusted alternatives.

Summary

The mangomind-agent npm package (versions 0.1.0 through 0.2.1, specifically listed) includes a backdoor that connects to wss://relay.mangomindbd.com. The package listens for messages from this relay and executes commands from the relay operator via child_process.execSync, allowing arbitrary command execution. It also proxies requests to a local AI coding agent, granting the relay operator filesystem and shell access. The only gate is a token handshake controlled by the relay operator, meaning full remote control is possible for anyone controlling the relay server. This is a malicious package rather than a typical vulnerability.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:18 UTC

Technical details

References

Community reviews