🛡️ MAL-2026-10707 — cli

Malicious code in @ai-support-agent/cli (npm)

Source: amazon-inspector

The @ai-support-agent/cli package installs a long-running daemon (ai-support-agent start) that connects to a vendor API (default wss://api.ai-support-agent.com/ws/agent-terminal and matching AppSync/HTTP endpoints) and executes remote-delivered commands against the local host. In dist/vscode/vscode-server.js and related files, handleStdin base64-decodes WebSocket message payloads and writes them straight into a local PTY (session.write(decoded)), giving a caller with a valid token an interactive shell on the machine running the agent. A separate command-dispatch path handles structured messages including execute_command (shell), file_read/file_write/file_delete/file_mkdir, process_list/process_kill, chat (spawns Claude Code / arbitrary subprocess), and setup/reboot/update, streaming results back to the vendor. darwin-service.js and linux-service.js install the agent as a persistent system service that starts on boot, and the daemon reaches the vendor over the public internet by default. Anyone who legitimately holds — or who compromises — the vendor API endpoint has full-host remote code execution, filesystem read/write, process control, and reboot capability on every machine running this agent. The daemon behavior is documented as the product's purpose (Web UI drives remote shell/file/process operations), but the network-to-PTY and network-to-exec paths are a persistent backdoor by construction regardless of framing, and blast radius extends to any future compromise of the vendor's control plane.