{"id":"MAL-2026-10746","summary":"Malicious code in sakuraai (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e)\nWhen the daemon is started (e.g. via `sakura daemon start`), the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a Tailscale sidecar. The WebSocket handler spawns an interactive OS shell (`process.env.SHELL || /bin/zsh` on Unix, `cmd.exe` on Windows) with the `-i` flag and pipes incoming WebSocket `{type:'input', data:...}` frames directly into the shell's stdin, streaming stdout/stderr back over the same socket (dist/index.js: `spawn(shell, [\"-i\"],...)`, `writeTerminal(ws, msg.data)`, `server.listen(port, host === \"127.0.0.1\"? \"0.0.0.0\": host,...)`). Any party with network reachability to the daemon — anyone on the LAN, or anyone with a valid bearer token over the Tailscale tailnet — obtains full-host command execution as the user running the daemon. A separate `postinstall` script (`scripts/download-tsnet.js`, `scripts/download-onboard.js`) fetches `sakura-tsnet` / `sakura-onboard` binaries from `https://github.com/Nishu0/sakura-tsnet/releases/download/v\u003cversion\u003e/...` over HTTPS, pinned to the package version but without hash/signature verification; the publishing GitHub account (`Nishu0`) is a personal account rather than an organization matching the advertised `Sakura` / `sakura.mom` publisher identity.\n","modified":"2026-07-16T19:19:58.649133158Z","published":"2026-07-16T18:44:06Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010764","import_time":"2026-07-16T18:54:03.396182305Z","modified_time":"2026-07-16T18:44:06Z","sha256":"d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e","source":"amazon-inspector","versions":["0.0.11"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sakuraai/v/0.0.11"}],"affected":[{"package":{"name":"sakuraai","ecosystem":"npm","purl":"pkg:npm/sakuraai"},"versions":["0.0.11"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"8c80a8b573eb9134bb0241fb64de1338401d337595f3a817cce1ebd4664a9a2b","tlsh":"40a3d71968f7653612b371a91f2f901a773a94033249d994bfec93901f8963cd2b3b9c","path":"dist/index.js"},{"tlsh":"0761971e84a31f303bf269a95a0d505fee6b01563307e938b07c97543f8112891d36fe","path":"scripts/download-tsnet.js","sha256":"946595ca1a21f8b7338c06bc8cf791ae59fdd1955bee1448fc642eb521d704be"}],"package_integrity":[{"filename":"sakuraai-0.0.11.tgz","hashes":{"sha1":"8854e925b166ba8d9ed41cfc19ee140786e7b55b","sha512_sri":"sha512-OtXza9wDPbQQS0UT8i1RX02dLieFzp7ZZJGbU9ihl6rL63jkg8EtcBSD4pPSJs1tAXSPS5QFy6e+k1gslSy1GQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sakuraai/MAL-2026-10746.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}