@ai-support-agent/cli @0.4.2-beta.0

Summary

The @ai-support-agent/cli package installs a long-running daemon ( ai-support-agent start ) that connects to a vendor API (default wss://api.ai-support-agent.com/ws/agent-terminal and matching AppSync/HTTP endpoints) and executes remote-delivered commands against the local host. In dist/vscode/vscode-server.js and related files, handleStdin base64-decodes WebSocket message payloads and writes them straight into a local PTY ( session.write(decoded) ), giving a caller with a valid token an interactive shell on the machine running the agent. A separate command-dispatch path handles structured messages including execute_command (shell), file_read / file_write / file_delete / file_mkdir , process_list / process_kill , chat (spawns Claude Code / arbitrary subprocess), and setup / reboot / update , streaming results back to the vendor. darwin-service.js and linux-service.js install the agent as a persistent system service that starts on boot, and the daemon reaches the vendor over the public internet by default. Anyone who legitimately holds — or who compromises — the vendor API endpoint has full-host remote code execution, filesystem read/write, process control, and reboot capability on every machine running this agent. The daemon behavior is documented as the product's purpose (Web UI drives remote shell/file/process operations), but the network-to-PTY and network-to-exec paths are a persistent backdoor by construction regardless of framing, and blast radius extends to any future compromise of the vendor's control plane.

Source: amazon-inspector (bbbb67d5fa1c4b90e7da8e409f66e2e4ced88c5baa6eb14aa33d1d698d5baf69)