9remote

{"modified":"2026-08-06T14:21:50Z","published":"2026-08-06T13:15:46Z","schema_version":"1.7.4","id":"MAL-2026-13406","summary":"Malicious code in 9remote (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0)\n9remote is a remote-shell tool: its CLI launches an HTTP/WebSocket server and provisions a Cloudflare Quick Tunnel that exposes the host to the public internet at a 9remote.cc-fronted URL. Incoming WebSocket `input` messages are forwarded verbatim into a locally spawned PTY (bash/zsh on Unix, cmd.exe/powershell.exe on Windows) via `pty.write(s.data)`, after `spawn(o.path, o.args,...)` in the pty daemon. The server's router treats requests bearing the `cf-connecting-ip` header as remote-authorized. Access is gated by a short-lived (~30-minute) one-time pair key shown as a QR code; anyone who obtains that key over the tunnel obtains a full interactive shell on the host with the user's privileges. The package is invoked explicitly by the operator (bin entry, not lifecycle scripts or top-level require side effects), and the tunnel terminates at first-party infrastructure (9remote.cc / Cloudflare), so this is the advertised behavior of the tool rather than a covert channel — but the blast radius on any host where the CLI is run is full-host remote code execution behind a single short-lived key.\n","affected":[{"package":{"ecosystem":"npm","name":"9remote"},"versions":["2.1.5","2.1.14","2.1.20","2.1.9","2.1.16","2.1.21","2.1.6","2.2.5","2.2.6","2.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/ptyDaemon.cjs","sha256":"bf538f727ef3765886bfd179501e68963cc7f68d235760ba8d8cf1557950e74b","tlsh":"9d02fae6734976ebcbe092618867012095b6be15b405346cf3c4fdef2f205d065eab15"},{"path":"dist/install.cjs","sha256":"36aa466fc8e97547c9813d26e3cdf74acf39b017916ab7a07bf71c91189c2d5f","tlsh":"324165d2178067b92ed0d55aca9e040793784a38142ce0d4e2dcceea29b607603e5f75"}],"package_integrity":[{"filename":"9remote-2.1.5.tgz","hashes":{"sha1":"30386dc5b5bed37fe38ae28da5d126356282d4d6","sha512_sri":"sha512-CqPGwNoeAogfdgHKhWDKwNkkFcfJ5ZITsgEivZxHH9EcDAD6j4Wz/Dh2qsWGxl4iisu4Bm/352Un7J3YrlYC0w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.20"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.2.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.2.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/9remote/v/2.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016372","import_time":"2026-08-06T14:19:45.644247601Z","modified_time":"2026-08-06T13:16:18Z","sha256":"176c0f836027b6464583c707e532c2f8776dc299763837f3d0979aeb34ee34b3","source":"amazon-inspector","versions":["2.1.5"]},{"id":"IN-MAL-2026-016374","import_time":"2026-08-06T14:19:45.757757849Z","modified_time":"2026-08-06T13:16:37Z","sha256":"22a4e5c39f7a943e2cc2baef9292bc7bedd55600bddf5c829dcc8076211fda3b","source":"amazon-inspector","versions":["2.1.14"]},{"id":"IN-MAL-2026-016370","import_time":"2026-08-06T14:19:45.572754581Z","modified_time":"2026-08-06T13:15:58Z","sha256":"4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0","source":"amazon-inspector","versions":["2.1.20"]},{"id":"IN-MAL-2026-016377","import_time":"2026-08-06T14:19:45.997862881Z","modified_time":"2026-08-06T13:17:02Z","sha256":"50ecf084f7adfa9c742234b8137a3725ec71728b254950efe2b630c0e4cf57a8","source":"amazon-inspector","versions":["2.1.9"]},{"id":"IN-MAL-2026-016376","import_time":"2026-08-06T14:19:45.870202528Z","modified_time":"2026-08-06T13:16:53Z","sha256":"7017db3f7480a7357c78587e7d6f5ff85fcd3ccfc316f575fc17e60c20d5c592","source":"amazon-inspector","versions":["2.1.16"]},{"id":"IN-MAL-2026-016369","import_time":"2026-08-06T14:19:45.532558705Z","modified_time":"2026-08-06T13:15:46Z","sha256":"f0c4686e0ed2e8e4e8031eb4cc5618ade0e9be4885039d981132ad9b10637754","source":"amazon-inspector","versions":["2.1.21"]},{"id":"IN-MAL-2026-016373","import_time":"2026-08-06T14:19:45.673756672Z","modified_time":"2026-08-06T13:16:26Z","sha256":"342eab2cbe8adf419d7f9f08116929689111deef4595ce231b52e9e30aaabf1b","source":"amazon-inspector","versions":["2.1.6"]},{"id":"IN-MAL-2026-016378","import_time":"2026-08-06T14:19:46.036006436Z","modified_time":"2026-08-06T13:17:10Z","sha256":"348253e1e3b9ef12096655a25242b519780e85085f1c257c982a61caa64ab020","source":"amazon-inspector","versions":["2.2.5"]},{"id":"IN-MAL-2026-016375","import_time":"2026-08-06T14:19:45.795223461Z","modified_time":"2026-08-06T13:16:45Z","sha256":"47e410f8e3224069a52d658deb957bf5b5038a3b46123071a411f042470109bb","source":"amazon-inspector","versions":["2.2.6"]},{"id":"IN-MAL-2026-016371","import_time":"2026-08-06T14:19:45.600050076Z","modified_time":"2026-08-06T13:16:06Z","sha256":"5dc6eeb1739454cc986c504bdd701856a793eaf823057761fc9133cf5234b3b2","source":"amazon-inspector","versions":["2.1.1"]}]}}