sakuraai

{"modified":"2026-07-16T18:44:06Z","published":"2026-07-16T18:44:06Z","schema_version":"1.7.4","id":"MAL-2026-10746","summary":"Malicious code in sakuraai (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e)\nWhen the daemon is started (e.g. via `sakura daemon start`), the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a Tailscale sidecar. The WebSocket handler spawns an interactive OS shell (`process.env.SHELL || /bin/zsh` on Unix, `cmd.exe` on Windows) with the `-i` flag and pipes incoming WebSocket `{type:'input', data:...}` frames directly into the shell's stdin, streaming stdout/stderr back over the same socket (dist/index.js: `spawn(shell, [\"-i\"],...)`, `writeTerminal(ws, msg.data)`, `server.listen(port, host === \"127.0.0.1\"? \"0.0.0.0\": host,...)`). Any party with network reachability to the daemon — anyone on the LAN, or anyone with a valid bearer token over the Tailscale tailnet — obtains full-host command execution as the user running the daemon. A separate `postinstall` script (`scripts/download-tsnet.js`, `scripts/download-onboard.js`) fetches `sakura-tsnet` / `sakura-onboard` binaries from `https://github.com/Nishu0/sakura-tsnet/releases/download/v<version>/...` over HTTPS, pinned to the package version but without hash/signature verification; the publishing GitHub account (`Nishu0`) is a personal account rather than an organization matching the advertised `Sakura` / `sakura.mom` publisher identity.\n","affected":[{"package":{"ecosystem":"npm","name":"sakuraai"},"versions":["0.0.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"8c80a8b573eb9134bb0241fb64de1338401d337595f3a817cce1ebd4664a9a2b","tlsh":"40a3d71968f7653612b371a91f2f901a773a94033249d994bfec93901f8963cd2b3b9c"},{"path":"scripts/download-tsnet.js","sha256":"946595ca1a21f8b7338c06bc8cf791ae59fdd1955bee1448fc642eb521d704be","tlsh":"0761971e84a31f303bf269a95a0d505fee6b01563307e938b07c97543f8112891d36fe"}],"package_integrity":[{"filename":"sakuraai-0.0.11.tgz","hashes":{"sha1":"8854e925b166ba8d9ed41cfc19ee140786e7b55b","sha512_sri":"sha512-OtXza9wDPbQQS0UT8i1RX02dLieFzp7ZZJGbU9ihl6rL63jkg8EtcBSD4pPSJs1tAXSPS5QFy6e+k1gslSy1GQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sakuraai/v/0.0.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010764","import_time":"2026-07-16T18:54:03.396182305Z","modified_time":"2026-07-16T18:44:06Z","sha256":"d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e","source":"amazon-inspector","versions":["0.0.11"]}]}}