MAL-2026-10725

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agentto/MAL-2026-10725.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10725
Published
2026-07-16T18:44:25Z
Modified
2026-07-16T19:19:40.598295076Z
Summary
Malicious code in agentto (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8cd82c93e5f7bc0005dec9fbf18f01ec45bb6e6d2fb97bad2479c0209a7414bf)

agentto@0.5.36 opens a WebSocket to the hardcoded server wss://link.agentto.net and routes terminal.* RPC frames received from that server into a shell/PTY spawned on the installer's host. The terminal.input handler (host/terminal-service.mjs around line 135) base64-decodes params.dataBase64 from remote messages and writes the bytes to a PTY spawned as /bin/sh -l (or the user's $SHELL); the RPC dispatcher forwards any terminal.* method arriving on the relay socket to this host terminal service. The host terminal is enabled by default and only disabled via the environment variable AGENTTO_TERMINAL_ENABLED=0. Any party controlling link.agentto.net therefore obtains interactive shell execution as the running user on every host that starts this connector with defaults.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.5.36"
            ],
            "import_time": "2026-07-16T18:54:03.584323362Z",
            "modified_time": "2026-07-16T18:44:25Z",
            "source": "amazon-inspector",
            "sha256": "8cd82c93e5f7bc0005dec9fbf18f01ec45bb6e6d2fb97bad2479c0209a7414bf",
            "id": "IN-MAL-2026-010766"
        }
    ]
}
References
Credits

Affected packages

npm / agentto

Package

Name
agentto
View open source insights on deps.dev
Purl
pkg:npm/agentto

Affected ranges

Affected versions

0.*
0.5.36

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agentto/MAL-2026-10725.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "agentto-0.5.36.tgz",
            "hashes": {
                "sha512_sri": "sha512-wW9fx6G2FILhM+IlDHUnGvEIIiBkfIOYL+xhKlmHLWv8mEA9SdvN9OaztcxZAnr2TY7+pV4dnzHXAevLT5Q4mg==",
                "sha1": "7c90fbec6d1fc4424c5e72da7fff42231c6afb9e"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "host/terminal-service.mjs",
            "sha256": "cbc2a537a7ce16da3d6141b7f6cb303c1c7419675cd859d51fa4463e3740431c",
            "tlsh": "1682f01a2dfb133253a260b51b870312722691373509f998fd7c4ad45f874fca5e6be4"
        },
        {
            "path": "native-runtime-manager.mjs",
            "sha256": "0046ade32142326e1058a215bf8306d31f7a1c741599f8efef6766f253678f54",
            "tlsh": "9241194559c2a162c673e6af0e6bd050f3309e43380ca891799c838c3fdb29c83b039c"
        }
    ]
}