{"id":"MAL-2026-13445","summary":"Malicious code in elephant-tusk-runner (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ddbdcdca1756bee69586881547c9e63f555685a2e5e3daa68a9519987edd37a)\nserver.js starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0.0.0, with fully open CORS (Access-Control-Allow-Origin: *) and no authentication. A WebSocket route /terminal-stream and HTTP POST /api/v1/workspace-terminal-command each spawn a bash or powershell.exe PTY and pipe network-received bytes directly into ptySession.write(...), giving any peer that can reach port 4201 an interactive shell on the host running the tool. Additional endpoints on the same listener call child_process.exec with attacker-controllable arguments, including `git clone --depth=1 ${targetGitUrl}...`, `composer install && php artisan key:generate`, `npm install`, `php \"${terminalFile}\"`, and taskkill/kill on arbitrary PIDs, plus a fetch-proxy that forwards arbitrary target URLs. The listener is started by `npm start` and by the `tusk`/`elephant` CLI shipped in the package's bin entries. On any developer or build machine on a shared or reachable network, this exposes a full remote-shell and remote-code-execution surface for the duration the tool runs.\n","modified":"2026-08-06T23:50:12.898338692Z","published":"2026-08-06T19:20:04Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-06T19:20:04Z","sha256":"4ddbdcdca1756bee69586881547c9e63f555685a2e5e3daa68a9519987edd37a","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-016760","import_time":"2026-08-06T23:25:07.927039821Z"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-016761","import_time":"2026-08-06T23:25:07.962380072Z","modified_time":"2026-08-06T19:20:12Z","sha256":"b5b1cb934c9fc454063b9840e00e71a668fb1a51fe35996cde98a83a375d7159"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/elephant-tusk-runner/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/elephant-tusk-runner/v/1.0.0"}],"affected":[{"package":{"name":"elephant-tusk-runner","ecosystem":"npm","purl":"pkg:npm/elephant-tusk-runner"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"a54e7620b1e043a199c7ec29f0b59cc4ee58a2a75eb9ae25731ec3d3ab82d3a3","tlsh":"1673f946a56212660bb6a36ddb035805eb26d463f3098158fdacc3142ff2798c1b3fde","path":"server.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-KQMgt+5DWFoEZD5OmogiWGRHLfuhQagDAKe1Ig7fPxcd+a2DtPTMadkC88W3P5039/OgE0JSDH8kUAR5oknFWw==","sha1":"d6124cc400507ce43330d99c974673e5bd948c0e"},"filename":"elephant-tusk-runner-1.0.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/elephant-tusk-runner/MAL-2026-13445.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}