MAL-2026-13406

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/9remote/MAL-2026-13406.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13406
Published
2026-08-06T13:15:46Z
Modified
2026-08-06T14:34:54.140406047Z
Summary
Malicious code in 9remote (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0)

9remote is a remote-shell tool: its CLI launches an HTTP/WebSocket server and provisions a Cloudflare Quick Tunnel that exposes the host to the public internet at a 9remote.cc-fronted URL. Incoming WebSocket input messages are forwarded verbatim into a locally spawned PTY (bash/zsh on Unix, cmd.exe/powershell.exe on Windows) via pty.write(s.data), after spawn(o.path, o.args,...) in the pty daemon. The server's router treats requests bearing the cf-connecting-ip header as remote-authorized. Access is gated by a short-lived (~30-minute) one-time pair key shown as a QR code; anyone who obtains that key over the tunnel obtains a full interactive shell on the host with the user's privileges. The package is invoked explicitly by the operator (bin entry, not lifecycle scripts or top-level require side effects), and the tunnel terminates at first-party infrastructure (9remote.cc / Cloudflare), so this is the advertised behavior of the tool rather than a covert channel — but the blast radius on any host where the CLI is run is full-host remote code execution behind a single short-lived key.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "2.1.5"
            ],
            "id": "IN-MAL-2026-016372",
            "import_time": "2026-08-06T14:19:45.644247601Z",
            "modified_time": "2026-08-06T13:16:18Z",
            "source": "amazon-inspector",
            "sha256": "176c0f836027b6464583c707e532c2f8776dc299763837f3d0979aeb34ee34b3"
        },
        {
            "versions": [
                "2.1.14"
            ],
            "id": "IN-MAL-2026-016374",
            "import_time": "2026-08-06T14:19:45.757757849Z",
            "modified_time": "2026-08-06T13:16:37Z",
            "source": "amazon-inspector",
            "sha256": "22a4e5c39f7a943e2cc2baef9292bc7bedd55600bddf5c829dcc8076211fda3b"
        },
        {
            "versions": [
                "2.1.20"
            ],
            "id": "IN-MAL-2026-016370",
            "import_time": "2026-08-06T14:19:45.572754581Z",
            "modified_time": "2026-08-06T13:15:58Z",
            "source": "amazon-inspector",
            "sha256": "4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0"
        },
        {
            "modified_time": "2026-08-06T13:17:02Z",
            "id": "IN-MAL-2026-016377",
            "import_time": "2026-08-06T14:19:45.997862881Z",
            "versions": [
                "2.1.9"
            ],
            "source": "amazon-inspector",
            "sha256": "50ecf084f7adfa9c742234b8137a3725ec71728b254950efe2b630c0e4cf57a8"
        },
        {
            "modified_time": "2026-08-06T13:16:53Z",
            "id": "IN-MAL-2026-016376",
            "import_time": "2026-08-06T14:19:45.870202528Z",
            "versions": [
                "2.1.16"
            ],
            "source": "amazon-inspector",
            "sha256": "7017db3f7480a7357c78587e7d6f5ff85fcd3ccfc316f575fc17e60c20d5c592"
        },
        {
            "modified_time": "2026-08-06T13:15:46Z",
            "id": "IN-MAL-2026-016369",
            "import_time": "2026-08-06T14:19:45.532558705Z",
            "versions": [
                "2.1.21"
            ],
            "source": "amazon-inspector",
            "sha256": "f0c4686e0ed2e8e4e8031eb4cc5618ade0e9be4885039d981132ad9b10637754"
        },
        {
            "versions": [
                "2.1.6"
            ],
            "id": "IN-MAL-2026-016373",
            "import_time": "2026-08-06T14:19:45.673756672Z",
            "modified_time": "2026-08-06T13:16:26Z",
            "source": "amazon-inspector",
            "sha256": "342eab2cbe8adf419d7f9f08116929689111deef4595ce231b52e9e30aaabf1b"
        },
        {
            "modified_time": "2026-08-06T13:17:10Z",
            "id": "IN-MAL-2026-016378",
            "import_time": "2026-08-06T14:19:46.036006436Z",
            "versions": [
                "2.2.5"
            ],
            "source": "amazon-inspector",
            "sha256": "348253e1e3b9ef12096655a25242b519780e85085f1c257c982a61caa64ab020"
        },
        {
            "versions": [
                "2.2.6"
            ],
            "id": "IN-MAL-2026-016375",
            "import_time": "2026-08-06T14:19:45.795223461Z",
            "modified_time": "2026-08-06T13:16:45Z",
            "source": "amazon-inspector",
            "sha256": "47e410f8e3224069a52d658deb957bf5b5038a3b46123071a411f042470109bb"
        },
        {
            "modified_time": "2026-08-06T13:16:06Z",
            "id": "IN-MAL-2026-016371",
            "import_time": "2026-08-06T14:19:45.600050076Z",
            "versions": [
                "2.1.1"
            ],
            "source": "amazon-inspector",
            "sha256": "5dc6eeb1739454cc986c504bdd701856a793eaf823057761fc9133cf5234b3b2"
        }
    ]
}
References
Credits

Affected packages

npm / 9remote

Package

Name
9remote
View open source insights on deps.dev
Purl
pkg:npm/9remote

Affected ranges

Affected versions

2.*
2.1.1
2.1.5
2.1.6
2.1.9
2.1.14
2.1.16
2.1.20
2.1.21
2.2.5
2.2.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/9remote/MAL-2026-13406.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "9remote-2.1.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-CqPGwNoeAogfdgHKhWDKwNkkFcfJ5ZITsgEivZxHH9EcDAD6j4Wz/Dh2qsWGxl4iisu4Bm/352Un7J3YrlYC0w==",
                "sha1": "30386dc5b5bed37fe38ae28da5d126356282d4d6"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "dist/ptyDaemon.cjs",
            "tlsh": "9d02fae6734976ebcbe092618867012095b6be15b405346cf3c4fdef2f205d065eab15",
            "sha256": "bf538f727ef3765886bfd179501e68963cc7f68d235760ba8d8cf1557950e74b"
        },
        {
            "path": "dist/install.cjs",
            "tlsh": "324165d2178067b92ed0d55aca9e040793784a38142ce0d4e2dcceea29b607603e5f75",
            "sha256": "36aa466fc8e97547c9813d26e3cdf74acf39b017916ab7a07bf71c91189c2d5f"
        }
    ]
}