{"answers":{"affected":"1 open source package ship an affected version, including @ai-support-agent/cli.","exploited":"There is no known exploitation of MAL-2026-10707 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10707 is a malicious package in @ai-support-agent/cli, published on 16 Jul 2026."},"fix_prompt":"MAL-2026-10707 is a malicious package: @ai-support-agent/cli (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10707/ (Markdown: https://insights.sbomify.com/MAL-2026-10707/index.md)","id":"MAL-2026-10707","markdown":"https://insights.sbomify.com/MAL-2026-10707/index.md","name":"MAL-2026-10707","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The `@ai-support-agent/cli` package installs a long-running daemon (`ai-support-agent start`) that connects to a vendor API (default `wss://api.ai-support-agent.com/ws/agent-terminal` and matching AppSync/HTTP endpoints) and executes remote-delivered commands against the local host. In `dist/vscode/vscode-server.js` and related files, `handleStdin` base64-decodes WebSocket message payloads and writes them straight into a local PTY (`session.write(decoded)`), giving a caller with a valid token an interactive shell on the machine running the agent. A separate command-dispatch path handles structured messages including `execute_command` (shell), `file_read`/`file_write`/`file_delete`/`file_mkdir`, `process_list`/`process_kill`, `chat` (spawns Claude Code / arbitrary subprocess), and `setup`/`reboot`/`update`, streaming results back to the vendor. `darwin-service.js` and `linux-service.js` install the agent as a persistent system service that starts on boot, and the daemon reaches the vendor over the public internet by default. Anyone who legitimately holds — or who compromises — the vendor API endpoint has full-host remote code execution, filesystem read/write, process control, and reboot capability on every machine running this agent. The daemon behavior is documented as the product's purpose (Web UI drives remote shell/file/process operations), but the network-to-PTY and network-to-exec paths are a persistent backdoor by construction regardless of framing, and blast radius extends to any future compromise of the vendor's control plane.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @ai-support-agent/cli (npm)","id":"MAL-2026-10707","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@ai-support-agent/cli","purl":"pkg:npm/%40ai-support-agent/cli","source":"MAL-2026-10707"}],"products":null,"published":"2026-07-16","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10707/"}