portloop

{"modified":"2026-06-19T05:18:26Z","published":"2026-06-19T04:36:47Z","schema_version":"1.7.4","id":"MAL-2026-6194","summary":"Malicious code in portloop (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e745a79c5fb952105d93cc5d5f37bc77af9cc08d9a021f09a12d26416a29de3c)\nOn default invocation (e.g., `npx portloop` with no flags), the CLI runs in daemon+quiet+respawn mode and POSTs {id, hostname, host, url, port, user} to a hardcoded Cloudflare Worker registry at https://portloop-registry.yaz-b35.workers.dev/register using a hardcoded bearer token (index.js:46, index.js:80). A setInterval re-posts the same payload every 60 seconds, giving the registry operator continuous fleet visibility of every host running the tool. Opt-out is only via an undocumented `PORTLOOP_REGISTRY=off` env var. Additionally, the package exports a `daemon()` library function that spawns a detached background process which can stand up an SSH server bound to a public Cloudflare tunnel and load authorized keys from `https://github.com/<user>.keys` (index.js:124, index.js:686). A consuming package or a misconfigured caller invoking `require('portloop').daemon({ssh:true, github:'someone'})` results in a persistent remote-shell server on the host with attacker-controlled SSH keys, reachable from the public internet via the ephemeral tunnel. The combination of default-on silent registration, continuous heartbeating to a third-party endpoint, and an exported API that trivially provisions a public SSH backdoor constitutes a silent-relay of host identity plus a ready-to-use remote-access toolkit.\n","affected":[{"package":{"ecosystem":"npm","name":"portloop"},"versions":["1.6.0","1.14.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"4cfbfcb039a762ea70a8298503ca1b33b40556d2c067cd66b964f8165d9f0bc8","tlsh":"5b62ca6d5ab7013653a324bd5a9b402a6a76c1031301e8e0b91dd3e5afe113c43f7fea"}],"package_integrity":[{"filename":"portloop-1.6.0.tgz","hashes":{"sha1":"6291f04927a53d20220cd48332baaf36e66e968c","sha512_sri":"sha512-yGQrZbZnfNhv69Unc3m00ftnjAqrLWaHa/w+g3Dm0rHp+J3XMiUgwBVwOEiQpaQJAEP81gQtOVaoYzSiWBg1TA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/portloop/v/1.6.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/portloop/v/1.14.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007047","import_time":"2026-06-19T05:16:48.825685811Z","modified_time":"2026-06-19T04:36:51Z","sha256":"327fd2bad696897edd65479ff6bf336b0b16e89d13bb3d432be0cad1d46937f4","source":"amazon-inspector","versions":["1.6.0"]},{"id":"IN-MAL-2026-007046","import_time":"2026-06-19T05:16:48.708302907Z","modified_time":"2026-06-19T04:36:47Z","sha256":"e745a79c5fb952105d93cc5d5f37bc77af9cc08d9a021f09a12d26416a29de3c","source":"amazon-inspector","versions":["1.14.0"]}]}}