MAL-2026-10746

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sakuraai/MAL-2026-10746.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10746
Published
2026-07-16T18:44:06Z
Modified
2026-07-16T19:19:58Z
Summary
Malicious code in sakuraai (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e)

When the daemon is started (e.g. via sakura daemon start), the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a Tailscale sidecar. The WebSocket handler spawns an interactive OS shell (process.env.SHELL || /bin/zsh on Unix, cmd.exe on Windows) with the -i flag and pipes incoming WebSocket {type:'input', data:...} frames directly into the shell's stdin, streaming stdout/stderr back over the same socket (dist/index.js: spawn(shell, ["-i"],...), writeTerminal(ws, msg.data), server.listen(port, host === "127.0.0.1"? "0.0.0.0": host,...)). Any party with network reachability to the daemon — anyone on the LAN, or anyone with a valid bearer token over the Tailscale tailnet — obtains full-host command execution as the user running the daemon. A separate postinstall script (scripts/download-tsnet.js, scripts/download-onboard.js) fetches sakura-tsnet / sakura-onboard binaries from https://github.com/Nishu0/sakura-tsnet/releases/download/v<version>/... over HTTPS, pinned to the package version but without hash/signature verification; the publishing GitHub account (Nishu0) is a personal account rather than an organization matching the advertised Sakura / sakura.mom publisher identity.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010764",
            "import_time": "2026-07-16T18:54:03.396182305Z",
            "modified_time": "2026-07-16T18:44:06Z",
            "sha256": "d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e",
            "source": "amazon-inspector",
            "versions": [
                "0.0.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sakuraai

Package

Name
sakuraai
View open source insights on deps.dev
Purl
pkg:npm/sakuraai

Affected ranges

Affected versions

0.*
0.0.11

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "8c80a8b573eb9134bb0241fb64de1338401d337595f3a817cce1ebd4664a9a2b",
            "tlsh": "40a3d71968f7653612b371a91f2f901a773a94033249d994bfec93901f8963cd2b3b9c"
        },
        {
            "path": "scripts/download-tsnet.js",
            "sha256": "946595ca1a21f8b7338c06bc8cf791ae59fdd1955bee1448fc642eb521d704be",
            "tlsh": "0761971e84a31f303bf269a95a0d505fee6b01563307e938b07c97543f8112891d36fe"
        }
    ],
    "package_integrity": [
        {
            "filename": "sakuraai-0.0.11.tgz",
            "hashes": {
                "sha1": "8854e925b166ba8d9ed41cfc19ee140786e7b55b",
                "sha512_sri": "sha512-OtXza9wDPbQQS0UT8i1RX02dLieFzp7ZZJGbU9ihl6rL63jkg8EtcBSD4pPSJs1tAXSPS5QFy6e+k1gslSy1GQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sakuraai/MAL-2026-10746.json"