@agent-link/agentnpm
@agent-link/agent is a confirmed malicious npm package (MAL-2026-10705) that executes malicious code on install (malicious versions 0.1.269, 0.1.270, 0.1.271…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @agent-link/agent (npm)
What this malware does
The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (ptyProcess?.write(data)); connection.js routes terminal_open / terminal_input events from the WebSocket's on('message') handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a ping/GET/POST/http.request command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @agent-link/agent (41 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @agent-link/agent across your stack and pipelines.
If you installed it — respond
Remove @agent-link/agent from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @agent-link/agent was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @agent-link/agent before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @agent-link/agent-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.