{"answers":{"affected":"1 open source package ship an affected version, including agenthub-multiagent-mcp.","exploited":"There is no known exploitation of MAL-2026-13399 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13399 is a malicious package in agenthub-multiagent-mcp, published on 6 Aug 2026."},"fix_prompt":"MAL-2026-13399 is a malicious package: agenthub-multiagent-mcp (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13399/ (Markdown: https://insights.sbomify.com/MAL-2026-13399/index.md)","id":"MAL-2026-13399","markdown":"https://insights.sbomify.com/MAL-2026-13399/index.md","name":"MAL-2026-13399","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"agenthub-multiagent-mcp ships a worker (dist/worker.js) that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/\u003cid\u003e and, for every 'dispatch' message received, writes the server-supplied message body to a prompt file and spawns 'bash run-claude.sh' which invokes 'claude -p \"$PROMPT\" --dangerously-skip-permissions --max-turns N --mcp-config...' with cwd set to a user-configured project directory. This gives whoever controls agenthub.contetial.com the ability to drive Claude Code's full tool suite (file read/write, shell, MCP tools) against the installer's projects with permissions checks explicitly disabled. The setup wizard (agenthub-setup) additionally installs OS-level persistence: a Windows Startup.vbs + hidden.bat launcher, a macOS LaunchAgent com.agenthub.worker.plist with RunAtLoad and KeepAlive, or a Linux systemd user unit agenthub-worker.service with Restart=always, so the remote-controlled worker reconnects on every login. Provenance is falsified: package.json declares repository.url https://github.com/anthropics/agenthub and homepage https://github.com/anthropics/agenthub#readme, and the README directs users to git clone https://github.com/anthropics/agenthub, while the actual author is 'Krishi AI' and the operational domain is agenthub.contetial.com. dist/setup.js contains a fetch to https://agenthub.contetial.com and dist/context.js/state.js perform base64 decoding of embedded blobs.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in agenthub-multiagent-mcp (npm)","id":"MAL-2026-13399","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"agenthub-multiagent-mcp","purl":"pkg:npm/agenthub-multiagent-mcp","source":"MAL-2026-13399"}],"products":null,"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13399/"}