The agenthub-ai npm package runs a persistent daemon that connects to a hardcoded WebSocket server controlled by the package maintainer or potentially an attacker who compromises that server. This daemon can execute server-supplied commands with broad file system access and spawn subprocesses, enabling full host control. It also supports a remote update mechanism that can force the installation of new code versions. Additionally, the package redirects native bindings to a placeholder package, which could be replaced later with malicious payloads. The daemon activates only when the package's binary is run, not during installation or import.