Is @agent-link/agent safe?

The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (ptyProcess?.write(data)); connection.js routes terminal_open / terminal_input events from the WebSocket's on('message') handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a ping/GET/POST/http.request command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.

Reported by Amazon Inspector via OSV.

Malicious

0.1.269, 0.1.325, 0.1.319, 0.1.285, 0.1.280, 0.1.272, 0.1.310, 0.1.293, 0.1.283, 0.1.299, 0.1.279, 0.1.308, 0.1.294, 0.1.281, 0.1.287, 0.1.320, 0.1.323, 0.1.270, 0.1.303, 0.1.316, 0.1.322, 0.1.277, 0.1.278, 0.1.284, 0.1.311, 0.1.296, 0.1.324, 0.1.275, 0.1.318, 0.1.274, 0.1.312, 0.1.298, 0.1.302, 0.1.292, 0.1.282, 0.1.304, 0.1.314, 0.1.273, 0.1.271, 0.1.289, 0.1.307

Move to

0.1.346 newest 0.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @agent-link/agent@0.1.346

OSV recordreferencereferencereferencereferencereferencereferencereferencereferencereference