If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912)
The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` / `terminal_input` events from the WebSocket's `on('message')` handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a `ping`/`GET`/`POST`/`http.request` command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.