elephant-tusk-runner

{"modified":"2026-08-06T23:29:18Z","published":"2026-08-06T19:20:04Z","schema_version":"1.7.4","id":"MAL-2026-13445","summary":"Malicious code in elephant-tusk-runner (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ddbdcdca1756bee69586881547c9e63f555685a2e5e3daa68a9519987edd37a)\nserver.js starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0.0.0, with fully open CORS (Access-Control-Allow-Origin: *) and no authentication. A WebSocket route /terminal-stream and HTTP POST /api/v1/workspace-terminal-command each spawn a bash or powershell.exe PTY and pipe network-received bytes directly into ptySession.write(...), giving any peer that can reach port 4201 an interactive shell on the host running the tool. Additional endpoints on the same listener call child_process.exec with attacker-controllable arguments, including `git clone --depth=1 ${targetGitUrl}...`, `composer install && php artisan key:generate`, `npm install`, `php \"${terminalFile}\"`, and taskkill/kill on arbitrary PIDs, plus a fetch-proxy that forwards arbitrary target URLs. The listener is started by `npm start` and by the `tusk`/`elephant` CLI shipped in the package's bin entries. On any developer or build machine on a shared or reachable network, this exposes a full remote-shell and remote-code-execution surface for the duration the tool runs.\n","affected":[{"package":{"ecosystem":"npm","name":"elephant-tusk-runner"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"server.js","sha256":"a54e7620b1e043a199c7ec29f0b59cc4ee58a2a75eb9ae25731ec3d3ab82d3a3","tlsh":"1673f946a56212660bb6a36ddb035805eb26d463f3098158fdacc3142ff2798c1b3fde"}],"package_integrity":[{"filename":"elephant-tusk-runner-1.0.1.tgz","hashes":{"sha1":"d6124cc400507ce43330d99c974673e5bd948c0e","sha512_sri":"sha512-KQMgt+5DWFoEZD5OmogiWGRHLfuhQagDAKe1Ig7fPxcd+a2DtPTMadkC88W3P5039/OgE0JSDH8kUAR5oknFWw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/elephant-tusk-runner/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/elephant-tusk-runner/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016760","import_time":"2026-08-06T23:25:07.927039821Z","modified_time":"2026-08-06T19:20:04Z","sha256":"4ddbdcdca1756bee69586881547c9e63f555685a2e5e3daa68a9519987edd37a","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-016761","import_time":"2026-08-06T23:25:07.962380072Z","modified_time":"2026-08-06T19:20:12Z","sha256":"b5b1cb934c9fc454063b9840e00e71a668fb1a51fe35996cde98a83a375d7159","source":"amazon-inspector","versions":["1.0.0"]}]}}