If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (bbbb67d5fa1c4b90e7da8e409f66e2e4ced88c5baa6eb14aa33d1d698d5baf69)
The `@ai-support-agent/cli` package installs a long-running daemon (`ai-support-agent start`) that connects to a vendor API (default `wss://api.ai-support-agent.com/ws/agent-terminal` and matching AppSync/HTTP endpoints) and executes remote-delivered commands against the local host. In `dist/vscode/vscode-server.js` and related files, `handleStdin` base64-decodes WebSocket message payloads and writes them straight into a local PTY (`session.write(decoded)`), giving a caller with a valid token an interactive shell on the machine running the agent. A separate command-dispatch path handles structured messages including `execute_command` (shell), `file_read`/`file_write`/`file_delete`/`file_mkdir`, `process_list`/`process_kill`, `chat` (spawns Claude Code / arbitrary subprocess), and `setup`/`reboot`/`update`, streaming results back to the vendor. `darwin-service.js` and `linux-service.js` install the agent as a persistent system service that starts on boot, and the daemon reaches the vendor over the public internet by default. Anyone who legitimately holds — or who compromises — the vendor API endpoint has full-host remote code execution, filesystem read/write, process control, and reboot capability on every machine running this agent. The daemon behavior is documented as the product's purpose (Web UI drives remote shell/file/process operations), but the network-to-PTY and network-to-exec paths are a persistent backdoor by construction regardless of framing, and blast radius extends to any future compromise of the vendor's control plane.