{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist-publish/main.js",
              "sha256": "2a02e27b2b5e4a5e01bee5adb0078eb50afae24784151907de79fcec7effe2bc",
              "tlsh": "bea31a69b1ab283947dc92c2f8341151db751b14243b5439f2fddd8aaf288049ab7f3e"
            },
            {
              "path": "package.json",
              "sha256": "6320c0e753aab36ee742a6d7a0ae919e4cd47f27a4c9661ed0b9e8a92364f5cc",
              "tlsh": "1c41bba0d81f1cb32fc45ec87b650262d26a46335e163748b38e149b4f0e3afa87525d"
            }
          ],
          "package_integrity": [
            {
              "filename": "agenthub-ai-0.20.1.tgz",
              "hashes": {
                "sha1": "2c08184aecc36c15fe66074d8977d33f6bee42f8",
                "sha512_sri": "sha512-kz4gVfNSITXrxePYnRRFA06F6enKS7+J8usse6MitcJ0Zy8H+6n+ssUBJgzfllZvcrCs6bo7GuKtxV/zIHwW4g=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "agenthub-ai"
      },
      "versions": [
        "0.20.1",
        "0.20.2",
        "0.20.4",
        "0.20.3"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017108",
        "import_time": "2026-08-07T16:51:14.346332741Z",
        "modified_time": "2026-08-07T16:34:12Z",
        "sha256": "4f29f622134cd387e49d4293fb004554b677e44f972187d6798d6c885a3aa5b0",
        "source": "amazon-inspector",
        "versions": [
          "0.20.1"
        ]
      },
      {
        "id": "IN-MAL-2026-017110",
        "import_time": "2026-08-07T16:51:14.568039573Z",
        "modified_time": "2026-08-07T16:34:28Z",
        "sha256": "bf18e6219d53eab55eadad4192da8eb4be8d697fa9297b98418ae091019805d9",
        "source": "amazon-inspector",
        "versions": [
          "0.20.2"
        ]
      },
      {
        "id": "IN-MAL-2026-017109",
        "import_time": "2026-08-07T16:51:14.458865279Z",
        "modified_time": "2026-08-07T16:34:20Z",
        "sha256": "f173bbb1d6dbbd1f56296fed1aa3029f4c638f39cb00c2486cbaf3237c900449",
        "source": "amazon-inspector",
        "versions": [
          "0.20.4"
        ]
      },
      {
        "id": "IN-MAL-2026-017111",
        "import_time": "2026-08-07T16:51:14.680848395Z",
        "modified_time": "2026-08-07T16:34:38Z",
        "sha256": "bd9cfad0898e8a9b0e7ba8986c7350ee9cd768329c5fc2697608b12b34908147",
        "source": "amazon-inspector",
        "versions": [
          "0.20.3"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4f29f622134cd387e49d4293fb004554b677e44f972187d6798d6c885a3aa5b0)\nThe package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.fyenet.com and dispatches server-sent messages to handlers that read, write, and search files on the installer\u0027s machine and spawn the local Claude Agent CLI as a subprocess with server-supplied prompts (README documents bypassPermissions as the default). Any party controlling that server \u2014 the maintainer or anyone who compromises it \u2014 holds full-host action capability on every machine running the daemon. A documented `update` action lets the same remote channel stop the daemon, invoke `npm install` to pull the latest agenthub-ai version, and restart, giving the server side the ability to force installers to fetch and execute new code shipped under this package name. package.json also uses `overrides` to substitute every `@anthropic-ai/claude-agent-sdk-*` platform-native subpackage with `npm:agenthub-empty@1.0.0`, redirecting the upstream vendor\u0027s native bindings to a package under a different maintainer namespace; if that stub is later republished with a payload, every installer of agenthub-ai pulls it. The daemon fires only when the operator runs the package\u0027s bin, not at `npm install` or on `require()`.\n",
  "id": "MAL-2026-13615",
  "modified": "2026-08-07T16:53:08Z",
  "published": "2026-08-07T16:34:12Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/agenthub-ai/v/0.20.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/agenthub-ai/v/0.20.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/agenthub-ai/v/0.20.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/agenthub-ai/v/0.20.3"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in agenthub-ai (npm)"
}