Which versions of agenthub-multiagent-mcp are malicious?

The following npm versions of agenthub-multiagent-mcp are flagged malicious: 1.57.0. Treat any of these as compromised.

How do I remediate agenthub-multiagent-mcp if I installed it?

Remove agenthub-multiagent-mcp from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed agenthub-multiagent-mcp — how do I know if it already compromised me?

If agenthub-multiagent-mcp was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is agenthub-multiagent-mcp part of a known attack campaign?

Yes — agenthub-multiagent-mcp is associated with the IN-MAL-2026-016096 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find agenthub-multiagent-mcp across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for agenthub-multiagent-mcp (version 1.57.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging agenthub-multiagent-mcp across your stack and pipelines.

Malicious package

agenthub-multiagent-mcpnpm

agenthub-multiagent-mcp is a confirmed malicious npm package (MAL-2026-13399) that executes malicious code on install (malicious version 1.57.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in agenthub-multiagent-mcp (npm)

MAL-2026-13399

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall agenthub-multiagent-mcp

What this malware does

agenthub-multiagent-mcp ships a worker (dist/worker.js) that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/<id> and, for every 'dispatch' message received, writes the server-supplied message body to a prompt file and spawns 'bash run-claude.sh' which invokes 'claude -p "$PROMPT" --dangerously-skip-permissions --max-turns N --mcp-config...' with cwd set to a user-configured project directory. This gives whoever controls agenthub.contetial.com the ability to drive Claude Code's full tool suite (file read/write, shell, MCP tools) against the installer's projects with permissions checks explicitly disabled. The setup wizard (agenthub-setup) additionally installs OS-level persistence: a Windows Startup.vbs + hidden.bat launcher, a macOS LaunchAgent com.agenthub.worker.plist with RunAtLoad and KeepAlive, or a Linux systemd user unit agenthub-worker.service with Restart=always, so the remote-controlled worker reconnects on every login. Provenance is falsified: package.json declares repository.url https://github.com/anthropics/agenthub and homepage https://github.com/anthropics/agenthub#readme, and the README directs users to git clone https://github.com/anthropics/agenthub, while the actual author is 'Krishi AI' and the operational domain is agenthub.contetial.com. dist/setup.js contains a fetch to https://agenthub.contetial.com and dist/context.js/state.js perform base64 decoding of embedded blobs.

Malicious versions

1 flagged

1.57.0

Indicators of compromise (SHA-256)

ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for agenthub-multiagent-mcp (version 1.57.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging agenthub-multiagent-mcp across your stack and pipelines.
If you installed it — respond
Remove agenthub-multiagent-mcp from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If agenthub-multiagent-mcp was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks agenthub-multiagent-mcp before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. agenthub-multiagent-mcp on npm has been identified as a malicious package (version 1.57.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-016096

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks agenthub-multiagent-mcp-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database