MAL-2026-13399

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agenthub-multiagent-mcp/MAL-2026-13399.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13399
Published
2026-08-06T12:30:47Z
Modified
2026-08-06T13:34:54.754971530Z
Summary
Malicious code in agenthub-multiagent-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a)

agenthub-multiagent-mcp ships a worker (dist/worker.js) that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/<id> and, for every 'dispatch' message received, writes the server-supplied message body to a prompt file and spawns 'bash run-claude.sh' which invokes 'claude -p "$PROMPT" --dangerously-skip-permissions --max-turns N --mcp-config...' with cwd set to a user-configured project directory. This gives whoever controls agenthub.contetial.com the ability to drive Claude Code's full tool suite (file read/write, shell, MCP tools) against the installer's projects with permissions checks explicitly disabled. The setup wizard (agenthub-setup) additionally installs OS-level persistence: a Windows Startup.vbs + hidden.bat launcher, a macOS LaunchAgent com.agenthub.worker.plist with RunAtLoad and KeepAlive, or a Linux systemd user unit agenthub-worker.service with Restart=always, so the remote-controlled worker reconnects on every login. Provenance is falsified: package.json declares repository.url https://github.com/anthropics/agenthub and homepage https://github.com/anthropics/agenthub#readme, and the README directs users to git clone https://github.com/anthropics/agenthub, while the actual author is 'Krishi AI' and the operational domain is agenthub.contetial.com. dist/setup.js contains a fetch to https://agenthub.contetial.com and dist/context.js/state.js perform base64 decoding of embedded blobs.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016096",
            "import_time": "2026-08-06T13:08:48.901998744Z",
            "sha256": "ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a",
            "modified_time": "2026-08-06T12:30:47Z",
            "versions": [
                "1.57.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / agenthub-multiagent-mcp

Package

Name
agenthub-multiagent-mcp
View open source insights on deps.dev
Purl
pkg:npm/agenthub-multiagent-mcp

Affected ranges

Affected versions

1.*
1.57.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Hor9cwvDy6wvfgeW3bJ0U4OL6Bw7y/V+R8bpWuuA6xgw1I6IiRVD7jNEbE0T189Fbk1Y0t39km1unGYNBoTDpA==",
                "sha1": "c339a2c1bfbe0d4a80b3c800c0cb511f09488a6d"
            },
            "filename": "agenthub-multiagent-mcp-1.57.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "3be60ed23888e72f6843532db1ff0dc73aa46db8eb031659fc0360a9bf556e58",
            "path": "dist/worker.js",
            "tlsh": "36d2c58a58f7063202777028579f1005ba3aa2673644e9a47acc93449f5d72cc7f6fee"
        },
        {
            "path": "dist/setup.js",
            "sha256": "eb9f72ed2d00da4ecbaff51b642d8c915b9f266490b19f70e22fdb49a6ccecf5",
            "tlsh": "5e92b48a48f705360b736aa85b2f1505735ed123b248fc94768c97c46f76328c962bee"
        },
        {
            "sha256": "03a4eed9a7bb059df50eb413cf881e06ecf69250feb24a9f9a9c5aa1770e8961",
            "path": "package.json",
            "tlsh": "80410f6bc9ab8d7307b8a7c1fab60201f315432f9100988bb2b52a1ccff5297114bb58"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agenthub-multiagent-mcp/MAL-2026-13399.json"