Is @ai-support-agent/cli safe?

The @ai-support-agent/cli package installs a long-running daemon (ai-support-agent start) that connects to a vendor API (default wss://api.ai-support-agent.com/ws/agent-terminal and matching AppSync/HTTP endpoints) and executes remote-delivered commands against the local host. In dist/vscode/vscode-server.js and related files, handleStdin base64-decodes WebSocket message payloads and writes them straight into a local PTY (session.write(decoded)), giving a caller with a valid token an interactive shell on the machine running the agent. A separate command-dispatch path handles structured messages including execute_command (shell), file_read/file_write/file_delete/file_mkdir, process_list/process_kill, chat (spawns Claude Code / arbitrary subprocess), and setup/reboot/update, streaming results back to the vendor. darwin-service.js and linux-service.js install the agent as a persistent system service that starts on boot, and the daemon reaches the vendor over the public internet by default. Anyone who legitimately holds — or who compromises — the vendor API endpoint has full-host remote code execution, filesystem read/write, process control, and reboot capability on every machine running this agent. The daemon behavior is documented as the product's purpose (Web UI drives remote shell/file/process operations), but the network-to-PTY and network-to-exec paths are a persistent backdoor by construction regardless of framing, and blast radius extends to any future compromise of the vendor's control plane.

Reported by Amazon Inspector via OSV.

Malicious

0.3.2-beta.1, 0.4.2, 0.3.2-beta.15, 0.3.2-beta.9, 0.3.2-beta.2, 0.3.5-beta.5, 0.3.7-beta.0, 0.4.0, 0.3.2-beta.10, 0.3.5, 0.4.2-beta.0, 0.3.6, 0.3.6-beta.0, 0.3.2-beta.0, 0.3.2-beta.8, 0.4.1, 0.3.2-beta.5, 0.3.5-beta.3, 0.3.5-beta.0, 0.4.1-beta.1, 0.3.5-beta.4, 0.3.2-beta.3, 0.3.2-beta.11, 0.3.2, 0.3.2-beta.14, 0.3.3-beta.0, 0.3.2-beta.4, 0.3.6-beta.1, 0.3.5-beta.1

Move to

0.5.16 newest 0.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @ai-support-agent/cli@0.5.16

OSV recordreferencereferencereferencereferencereferencereferencereferencereferencereference