@ks-openclaw/kim

{"modified":"2026-08-04T22:32:00Z","published":"2026-08-04T22:04:54Z","schema_version":"1.7.4","id":"MAL-2026-11528","summary":"Malicious code in @ks-openclaw/kim (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a563317f01b921a7425ae16f740c8fa729db03087afacfea903db3dd90e15803)\nThe package's preinstall lifecycle script (preinstall.js) opens a TCP socket to the hardcoded remote host 120.55.170.103:8888, spawns cmd.exe, and pipes the shell's stdio through the socket, giving the remote party full interactive command execution on the installer's machine during `npm install`. The same script also collects installer host identifiers (os.hostname(), os.userInfo().username, os.platform(), process.version, process.cwd()) while the reverse shell is connected. Cover-story strings in the file (\"Proof of Concept\", \"Dependency Confusion\") do not change the observed behavior: install-time remote code execution against the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"@ks-openclaw/kim"},"versions":["99.0.0","99.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"7f6973bda337d8064d2e4b5fcf638ee27122dc5b3c7c8341476717bde7442bd2","tlsh":"57118ce5a5b5a53c26350be1943084232a77c21031c3b3f2f0bd419e5f82de98a265bd"}],"package_integrity":[{"filename":"kim-99.0.0.tgz","hashes":{"sha1":"4000dbd96166f15ce0519b7d202cd4b6514c36a0","sha512_sri":"sha512-cJ2BskoY5I/JcQq533A89jOZyTKrqxs0jMmEahQ6lzEGeogCYE6oi5wFLcul7JLqQcldBZFPFuq+tzX3gfdjUQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ks-openclaw/kim/v/99.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ks-openclaw/kim/v/99.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011323","import_time":"2026-08-04T22:30:10.939241995Z","modified_time":"2026-08-04T22:04:54Z","sha256":"a563317f01b921a7425ae16f740c8fa729db03087afacfea903db3dd90e15803","source":"amazon-inspector","versions":["99.0.0"]},{"id":"IN-MAL-2026-011344","import_time":"2026-08-04T22:30:11.878262765Z","modified_time":"2026-08-04T22:08:01Z","sha256":"f592a38ee5b43f5e5e918025c8b47284f72137174ff23cbcc6da80ad1d094376","source":"amazon-inspector","versions":["99.0.1"]}]}}