{"id":"MAL-2026-12505","summary":"Malicious code in @kyronixai/executer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297)\nThe package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming 'execution:request' messages into a set of executors that run on the installer's host. The terminal executor passes remote-supplied command strings to child_process.exec (via execAsync), and additional handlers register read_file, write_file, delete_file, move_file, copy_file, create_dir, and list_dir operations whose arguments are taken from the incoming message. Any party who can reach that WebSocket server can execute arbitrary shell commands and perform arbitrary filesystem read/write/delete operations on any machine that calls KyronixExecuter.connect(). The destination is a personal domain (harshitnakrani.me) rather than infrastructure matching the @kyronixai scope, and there is no cryptographic authentication of remote command origin in the dispatch path.\n","modified":"2026-08-05T14:35:00.703677461Z","published":"2026-08-05T13:38:10Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.5"],"id":"IN-MAL-2026-014986","import_time":"2026-08-05T14:19:49.527415418Z","modified_time":"2026-08-05T13:38:10Z","sha256":"48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kyronixai/executer/v/1.0.5"}],"affected":[{"package":{"name":"@kyronixai/executer","ecosystem":"npm","purl":"pkg:npm/%40kyronixai/executer"},"versions":["1.0.5"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-xoh8GtNHd1SnNIIAEvqVJEwGgonTlGGPmnp7AE5SBNDJISRbD+stp2q04qMJ35kcbA++doKPHES/IE9+sp3tZw==","sha1":"0e86502f10ffb6e867a3d58306f221b965a9ea7a"},"filename":"executer-1.0.5.tgz"}],"evidence_files":[{"tlsh":"b8d012a75d9807591064aee11b33c52702527788bd1cc4d8fc98d71bd2a3406467b7c3","path":"dist/utils/Constants.js","sha256":"c3f06beffbc0719ad195ae4935335845ef0909aa56d9e347dc477a151e8b9786"},{"sha256":"ca6db2ef1b8195a746c7db3ad2b0a4cd560509bbf9dbdc7d6565f6d71b368b66","tlsh":"4e617c9b994e8b2386eb7d48ae037093022354ca2506a05df3bc67e04f1a0dc6269ff5","path":"dist/client/KyronixClient.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kyronixai/executer/MAL-2026-12505.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}