{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/worker.js",
              "sha256": "3be60ed23888e72f6843532db1ff0dc73aa46db8eb031659fc0360a9bf556e58",
              "tlsh": "36d2c58a58f7063202777028579f1005ba3aa2673644e9a47acc93449f5d72cc7f6fee"
            },
            {
              "path": "dist/setup.js",
              "sha256": "eb9f72ed2d00da4ecbaff51b642d8c915b9f266490b19f70e22fdb49a6ccecf5",
              "tlsh": "5e92b48a48f705360b736aa85b2f1505735ed123b248fc94768c97c46f76328c962bee"
            },
            {
              "path": "package.json",
              "sha256": "03a4eed9a7bb059df50eb413cf881e06ecf69250feb24a9f9a9c5aa1770e8961",
              "tlsh": "80410f6bc9ab8d7307b8a7c1fab60201f315432f9100988bb2b52a1ccff5297114bb58"
            }
          ],
          "package_integrity": [
            {
              "filename": "agenthub-multiagent-mcp-1.57.0.tgz",
              "hashes": {
                "sha1": "c339a2c1bfbe0d4a80b3c800c0cb511f09488a6d",
                "sha512_sri": "sha512-Hor9cwvDy6wvfgeW3bJ0U4OL6Bw7y/V+R8bpWuuA6xgw1I6IiRVD7jNEbE0T189Fbk1Y0t39km1unGYNBoTDpA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "agenthub-multiagent-mcp"
      },
      "versions": [
        "1.57.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016096",
        "import_time": "2026-08-06T13:08:48.901998744Z",
        "modified_time": "2026-08-06T12:30:47Z",
        "sha256": "ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a",
        "source": "amazon-inspector",
        "versions": [
          "1.57.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a)\nagenthub-multiagent-mcp ships a worker (dist/worker.js) that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/\u003cid\u003e and, for every \u0027dispatch\u0027 message received, writes the server-supplied message body to a prompt file and spawns \u0027bash run-claude.sh\u0027 which invokes \u0027claude -p \"$PROMPT\" --dangerously-skip-permissions --max-turns N --mcp-config...\u0027 with cwd set to a user-configured project directory. This gives whoever controls agenthub.contetial.com the ability to drive Claude Code\u0027s full tool suite (file read/write, shell, MCP tools) against the installer\u0027s projects with permissions checks explicitly disabled. The setup wizard (agenthub-setup) additionally installs OS-level persistence: a Windows Startup.vbs + hidden.bat launcher, a macOS LaunchAgent com.agenthub.worker.plist with RunAtLoad and KeepAlive, or a Linux systemd user unit agenthub-worker.service with Restart=always, so the remote-controlled worker reconnects on every login. Provenance is falsified: package.json declares repository.url https://github.com/anthropics/agenthub and homepage https://github.com/anthropics/agenthub#readme, and the README directs users to git clone https://github.com/anthropics/agenthub, while the actual author is \u0027Krishi AI\u0027 and the operational domain is agenthub.contetial.com. dist/setup.js contains a fetch to https://agenthub.contetial.com and dist/context.js/state.js perform base64 decoding of embedded blobs.\n",
  "id": "MAL-2026-13399",
  "modified": "2026-08-06T12:30:47Z",
  "published": "2026-08-06T12:30:47Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/agenthub-multiagent-mcp/v/1.57.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in agenthub-multiagent-mcp (npm)"
}