@kyronixai/executer

{"modified":"2026-08-05T13:38:10Z","published":"2026-08-05T13:38:10Z","schema_version":"1.7.4","id":"MAL-2026-12505","summary":"Malicious code in @kyronixai/executer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297)\nThe package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming 'execution:request' messages into a set of executors that run on the installer's host. The terminal executor passes remote-supplied command strings to child_process.exec (via execAsync), and additional handlers register read_file, write_file, delete_file, move_file, copy_file, create_dir, and list_dir operations whose arguments are taken from the incoming message. Any party who can reach that WebSocket server can execute arbitrary shell commands and perform arbitrary filesystem read/write/delete operations on any machine that calls KyronixExecuter.connect(). The destination is a personal domain (harshitnakrani.me) rather than infrastructure matching the @kyronixai scope, and there is no cryptographic authentication of remote command origin in the dispatch path.\n","affected":[{"package":{"ecosystem":"npm","name":"@kyronixai/executer"},"versions":["1.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/utils/Constants.js","sha256":"c3f06beffbc0719ad195ae4935335845ef0909aa56d9e347dc477a151e8b9786","tlsh":"b8d012a75d9807591064aee11b33c52702527788bd1cc4d8fc98d71bd2a3406467b7c3"},{"path":"dist/client/KyronixClient.js","sha256":"ca6db2ef1b8195a746c7db3ad2b0a4cd560509bbf9dbdc7d6565f6d71b368b66","tlsh":"4e617c9b994e8b2386eb7d48ae037093022354ca2506a05df3bc67e04f1a0dc6269ff5"}],"package_integrity":[{"filename":"executer-1.0.5.tgz","hashes":{"sha1":"0e86502f10ffb6e867a3d58306f221b965a9ea7a","sha512_sri":"sha512-xoh8GtNHd1SnNIIAEvqVJEwGgonTlGGPmnp7AE5SBNDJISRbD+stp2q04qMJ35kcbA++doKPHES/IE9+sp3tZw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kyronixai/executer/v/1.0.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014986","import_time":"2026-08-05T14:19:49.527415418Z","modified_time":"2026-08-05T13:38:10Z","sha256":"48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297","source":"amazon-inspector","versions":["1.0.5"]}]}}