MAL-2026-12505

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kyronixai/executer/MAL-2026-12505.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12505
Published
2026-08-05T13:38:10Z
Modified
2026-08-05T14:35:00.703677461Z
Summary
Malicious code in @kyronixai/executer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297)

The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming 'execution:request' messages into a set of executors that run on the installer's host. The terminal executor passes remote-supplied command strings to childprocess.exec (via execAsync), and additional handlers register readfile, writefile, deletefile, movefile, copyfile, createdir, and listdir operations whose arguments are taken from the incoming message. Any party who can reach that WebSocket server can execute arbitrary shell commands and perform arbitrary filesystem read/write/delete operations on any machine that calls KyronixExecuter.connect(). The destination is a personal domain (harshitnakrani.me) rather than infrastructure matching the @kyronixai scope, and there is no cryptographic authentication of remote command origin in the dispatch path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:19:49.527415418Z",
            "sha256": "48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297",
            "id": "IN-MAL-2026-014986",
            "modified_time": "2026-08-05T13:38:10Z",
            "versions": [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @kyronixai/executer

Package

Name
@kyronixai/executer
View open source insights on deps.dev
Purl
pkg:npm/%40kyronixai/executer

Affected ranges

Affected versions

1.*
1.0.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-xoh8GtNHd1SnNIIAEvqVJEwGgonTlGGPmnp7AE5SBNDJISRbD+stp2q04qMJ35kcbA++doKPHES/IE9+sp3tZw==",
                "sha1": "0e86502f10ffb6e867a3d58306f221b965a9ea7a"
            },
            "filename": "executer-1.0.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "b8d012a75d9807591064aee11b33c52702527788bd1cc4d8fc98d71bd2a3406467b7c3",
            "sha256": "c3f06beffbc0719ad195ae4935335845ef0909aa56d9e347dc477a151e8b9786",
            "path": "dist/utils/Constants.js"
        },
        {
            "tlsh": "4e617c9b994e8b2386eb7d48ae037093022354ca2506a05df3bc67e04f1a0dc6269ff5",
            "sha256": "ca6db2ef1b8195a746c7db3ad2b0a4cd560509bbf9dbdc7d6565f6d71b368b66",
            "path": "dist/client/KyronixClient.js"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kyronixai/executer/MAL-2026-12505.json"