@junyoung-kim/reins

{"modified":"2026-08-06T23:29:17Z","published":"2026-08-06T16:53:28Z","schema_version":"1.7.4","id":"MAL-2026-13432","summary":"Malicious code in @junyoung-kim/reins (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475)\nThe `reins` CLI spawns a local pseudo-terminal via node-pty (default `/bin/bash` or `cmd.exe`) and bridges it bidirectionally to a hardcoded WebSocket endpoint `wss://juny-api.kr/relay`, with pairing coordinated through `https://arv.juny-api.kr`. Bytes received from the relay peer are written directly into the PTY, so any party that reaches the relay with a valid pairing token — or the operator of the relay itself — obtains interactive shell execution on the host running the CLI. The pairing secret is loaded from parent-directory `.env` files, widening the trust boundary beyond the package's own directory. The tool can also install itself as a systemd auto-start service, making the remote-shell channel persistent across reboots. Static analysis additionally flagged PATH modifications in `dist/cli.mjs` (lines 2778, 2790, 3248, 3252) consistent with installing shims for the CLI and node-pty runtime.\n","affected":[{"package":{"ecosystem":"npm","name":"@junyoung-kim/reins"},"versions":["0.1.7","0.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/cli.mjs","sha256":"be67e50f643f3166837a07f30efd2db686c10b8ed66582d0c42db18f9a441099","tlsh":"f0940a556afb20725463a0be2f1ba112b225a00b360add587fac56d45f4c53d82f3bfc"}],"package_integrity":[{"filename":"reins-0.1.7.tgz","hashes":{"sha1":"270033a4b85c05d274a78669145bad6f885fa561","sha512_sri":"sha512-js066zDMxB3v/81dyir/PhyCNnshNGHEEpfgdwUZO0iqhq6tZ/UIGta8fAzHRtc7GNFDoGLz5gDT2dGDs79isQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@junyoung-kim/reins/v/0.1.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@junyoung-kim/reins/v/0.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016740","import_time":"2026-08-06T18:09:13.39898324Z","modified_time":"2026-08-06T16:53:28Z","sha256":"a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475","source":"amazon-inspector","versions":["0.1.7"]},{"id":"IN-MAL-2026-016741","import_time":"2026-08-06T18:09:13.522373173Z","modified_time":"2026-08-06T16:53:38Z","sha256":"b67a86025d39aab07f1c67ee5f3a6d638d024cc63ca54fddbe0087ea3a9ff26d","source":"amazon-inspector","versions":["0.1.6"]}]}}