agenthub-multiagent-mcp @1.57.0

Summary

agenthub-multiagent-mcp ships a worker (dist/worker.js) that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/<id> and, for every 'dispatch' message received, writes the server-supplied message body to a prompt file and spawns 'bash run-claude.sh' which invokes 'claude -p "$PROMPT" --dangerously-skip-permissions --max-turns N --mcp-config...' with cwd set to a user-configured project directory. This gives whoever controls agenthub.contetial.com the ability to drive Claude Code's full tool suite (file read/write, shell, MCP tools) against the installer's projects with permissions checks explicitly disabled. The setup wizard (agenthub-setup) additionally installs OS-level persistence: a Windows Startup.vbs + hidden.bat launcher, a macOS LaunchAgent com.agenthub.worker.plist with RunAtLoad and KeepAlive, or a Linux systemd user unit agenthub-worker.service with Restart=always, so the remote-controlled worker reconnects on every login. Provenance is falsified: package.json declares repository.url https://github.com/anthropics/agenthub and homepage https://github.com/anthropics/agenthub#readme, and the README directs users to git clone https://github.com/anthropics/agenthub, while the actual author is 'Krishi AI' and the operational domain is agenthub.contetial.com. dist/setup.js contains a fetch to https://agenthub.contetial.com and dist/context.js/state.js perform base64 decoding of embedded blobs.

Source: amazon-inspector (ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a)