Supply chain · npm · High

Critical npm Package 'ubiquiti-agents-link-mcp' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-09-24

The npm package 'ubiquiti-agents-link-mcp' contains malware that fully compromises any system where it is installed. This poses a critical supply-chain risk, necessitating immediate action to rotate credentials and isolate affected systems.

  • Package: npm / ubiquiti-agents-link-mcp
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'ubiquiti-agents-link-mcp' has been identified as malicious, containing malware that leads to the full compromise of any computer on which it is installed or executed. The advisory indicates that all secrets and keys on such a system should be considered compromised.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the malware executes, granting an external entity full control over the compromised system, typically leading to credential theft or further system exploitation.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'ubiquiti-agents-link-mcp'

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest (malicious) version
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock)
  • Use of internal package mirrors that do not vet upstream packages
  • Automated build processes that install new or updated dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are stolen.
  • The compromised system can be used as a pivot point for further attacks within the network.
  • Sensitive data accessible from the compromised system may be exfiltrated.

What to do (defensive)

Detect

  • Scan dependency trees for 'ubiquiti-agents-link-mcp' in all projects.
  • Review package installation logs for evidence of 'ubiquiti-agents-link-mcp' being pulled.
  • Monitor network traffic for unusual outbound connections from systems that installed the package.

Contain

  • Immediately isolate any system identified as having installed 'ubiquiti-agents-link-mcp' from the network.
  • Suspend any CI/CD pipelines or automated processes that might install this package.
  • Block 'ubiquiti-agents-link-mcp' at your network perimeter or package registry.

Remediate

  • Consider any system that installed 'ubiquiti-agents-link-mcp' to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens, passwords) that were stored on or accessible from the compromised system, performing this action from a different, trusted computer.
  • Remove the package from affected systems, understanding that this may not fully remove all malicious software.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, credential rotation, and system rebuilds due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.