🛡️ MAL-2026-4628 — open-agents-ai

Malicious code in open-agents-ai (npm)

Source: amazon-inspector

package.json declares both preinstall and postinstall lifecycle hooks that invoke curl, and ships dist/postinstall-daemon.cjs — a Node script that loads child_process, fs, http, and os, calls execSync and http.request, reads os.userInfo() (lines 150, 385), checks for files via fs.existsSync, and executes ping commands at multiple call sites (lines 174, 288, 455, 681, 727). The combination of a postinstall-triggered Node daemon that harvests user/host identity (os.userInfo), probes the network (ping, http.request GET), and lifecycle scripts that additionally shell out to curl is the structural shape of an installer-side host-fingerprinting and exfiltration component, not a documented build step or vendor SDK fetch. There is no shipped native source tree, no publisher-pinned binary download, and no advertised purpose that would justify a postinstall daemon performing system-info collection and outbound HTTP from the installer's machine.