aclade-agent

{"modified":"2026-08-07T16:53:08Z","published":"2026-08-07T16:37:54Z","schema_version":"1.7.4","id":"MAL-2026-13614","summary":"Malicious code in aclade-agent (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d)\nThe package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported operations include execute_bash (child_process.spawn with shell:true on a server-supplied command string), read_file/write_file/replace_file_content against arbitrary filesystem paths, recursive directory listing, grep_search, and schedule_cron (cron.schedule wrapping child_process.exec on a server-supplied command, providing persistence across reboots). All task fields come from the network peer, giving aclade.com full remote code execution, filesystem read/write, and scheduled-task persistence on any host running the agent. The daemon additionally polls https://registry.npmjs.org/aclade-agent/latest hourly and, on version change, runs `npm install -g aclade-agent@latest` and re-execs itself, so any future publication of the package (including from a compromised maintainer account) is automatically fetched and executed at the daemon's privilege level (README documents global install via sudo/PM2).\n","affected":[{"package":{"ecosystem":"npm","name":"aclade-agent"},"versions":["1.0.5","1.0.2","1.0.1","1.0.6","1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"e8c8e5d8543c3306752eccbc484ed0b0e3d7e5717251f8cdcad431fab646ba5c","tlsh":"4832a71569fb503142b3b4ba6b4f9405b67aa003230cdda4be0ce3586f8543493fabed"}],"package_integrity":[{"filename":"aclade-agent-1.0.5.tgz","hashes":{"sha1":"5a50763b000bda771d7e0d3ffadda52a20523d3b","sha512_sri":"sha512-Ea37sT9s2SAuN4xIz5ytFh60mTMiJwp3driuC3SAOG19xqGdcAR7LNRj4oQStPN3cCLahbTWBNuJFOD/gg7Mxg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/aclade-agent/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/aclade-agent/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/aclade-agent/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/aclade-agent/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/aclade-agent/v/1.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017116","import_time":"2026-08-07T16:51:15.26964435Z","modified_time":"2026-08-07T16:38:02Z","sha256":"228b5c0bac20b8667155520d95e946b292167cd04c0fb9bf244d6f66200332ea","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-017117","import_time":"2026-08-07T16:51:15.375056687Z","modified_time":"2026-08-07T16:38:16Z","sha256":"46cdbc08753740ec1f23b0cb77a400e67741099c0c8cc743c4a86cb61ec6fd0b","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017118","import_time":"2026-08-07T16:51:15.509021266Z","modified_time":"2026-08-07T16:38:25Z","sha256":"8ef6554961bfa0fd7794f383f3d385cb79bf4ac1af60598343e782142d2e7058","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017115","import_time":"2026-08-07T16:51:15.097026436Z","modified_time":"2026-08-07T16:37:54Z","sha256":"a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d","source":"amazon-inspector","versions":["1.0.6"]},{"id":"IN-MAL-2026-017119","import_time":"2026-08-07T16:51:15.605103596Z","modified_time":"2026-08-07T16:38:39Z","sha256":"d8babf2ddba443878ed2357fc1991d98d268b775a9014ba8ad00d8d753ee4921","source":"amazon-inspector","versions":["1.0.4"]}]}}