MAL-2026-12505

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kyronixai/executer/MAL-2026-12505.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12505
Published
2026-08-05T13:38:10Z
Modified
2026-08-05T14:35:00Z
Summary
Malicious code in @kyronixai/executer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297)

The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming 'execution:request' messages into a set of executors that run on the installer's host. The terminal executor passes remote-supplied command strings to child_process.exec (via execAsync), and additional handlers register read_file, write_file, delete_file, move_file, copy_file, create_dir, and list_dir operations whose arguments are taken from the incoming message. Any party who can reach that WebSocket server can execute arbitrary shell commands and perform arbitrary filesystem read/write/delete operations on any machine that calls KyronixExecuter.connect(). The destination is a personal domain (harshitnakrani.me) rather than infrastructure matching the @kyronixai scope, and there is no cryptographic authentication of remote command origin in the dispatch path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014986",
            "import_time": "2026-08-05T14:19:49.527415418Z",
            "modified_time": "2026-08-05T13:38:10Z",
            "sha256": "48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @kyronixai/executer

Package

Name
@kyronixai/executer
View open source insights on deps.dev
Purl
pkg:npm/%40kyronixai/executer

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/utils/Constants.js",
            "sha256": "c3f06beffbc0719ad195ae4935335845ef0909aa56d9e347dc477a151e8b9786",
            "tlsh": "b8d012a75d9807591064aee11b33c52702527788bd1cc4d8fc98d71bd2a3406467b7c3"
        },
        {
            "path": "dist/client/KyronixClient.js",
            "sha256": "ca6db2ef1b8195a746c7db3ad2b0a4cd560509bbf9dbdc7d6565f6d71b368b66",
            "tlsh": "4e617c9b994e8b2386eb7d48ae037093022354ca2506a05df3bc67e04f1a0dc6269ff5"
        }
    ],
    "package_integrity": [
        {
            "filename": "executer-1.0.5.tgz",
            "hashes": {
                "sha1": "0e86502f10ffb6e867a3d58306f221b965a9ea7a",
                "sha512_sri": "sha512-xoh8GtNHd1SnNIIAEvqVJEwGgonTlGGPmnp7AE5SBNDJISRbD+stp2q04qMJ35kcbA++doKPHES/IE9+sp3tZw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kyronixai/executer/MAL-2026-12505.json"