# MAL-2026-10741: Malicious code in netcontrol-agent (npm)


- **Type:** Malicious package
- **Package:** `netcontrol-agent` (npm)
- **Published:** 16 Jul 2026

## What is MAL-2026-10741?

MAL-2026-10741 is a malicious package in netcontrol-agent, published on 16 Jul 2026. 

### Official description

netcontrol-agent.js implements a remote agent that long-polls a configured server URL and pipes the returned bytes directly into an interactive shell's stdin (cmd.exe on Windows, $SHELL or /bin/bash -i on Linux), while streaming stdout/stderr back to the server's /session/<id>/output endpoint. The relayLoop auto-attaches to any session the server advertises, so whoever controls NC_SERVER_URL obtains full interactive command execution on every host running the agent. The --install path escalates blast radius by writing a systemd unit that runs the agent as root, or a Windows scheduled task with /RU SYSTEM /RL HIGHEST /SC ONSTART, providing boot persistence at maximum privilege. An NC_AUTO_UPDATE mode downloads a replacement agent script from the same server and atomically overwrites AGENT_PATH, letting the server push arbitrary new code to installed hosts on the next poll. Collected host identifiers (os.hostname(), version) are also POSTed to the server. The remote-shell-plus-persistence-plus-self-update composition is a full backdoor mechanism regardless of the package's self-description.

## What should I do about MAL-2026-10741?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10741 is a malicious package: netcontrol-agent (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10741/ (Markdown: https://insights.sbomify.com/MAL-2026-10741/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10741

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10741/
Summaries are generated and may contain mistakes; the official description above is the record.