MAL-2026-13429

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@avi892nash/aegis-grid-runner/MAL-2026-13429.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13429
Published
2026-08-06T15:48:23Z
Modified
2026-08-06T23:50:26Z
Summary
Malicious code in @avi892nash/aegis-grid-runner (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00)

The package's default bin action starts an HTTP server (grid.mjs) that listens on GRID_RUNNER_PORT (default 7719). Incoming requests carry a base64-JSON x-job-meta header containing a cmd string plus a gzipped code tarball; the runner decodes the header, extracts the tarball, and invokes child_process.spawn on meta.cmd in a shell on the host running the runner. The runner boots unpaired by default and accepts pairing via POST /api/master; token authentication (GRID_TOKEN) is optional per README, so a peer able to reach the port can pair and drive arbitrary shell command execution on the host. The bundle also contains references to internal Juspay infrastructure (ssh://git@ssh.bitbucket.juspay.net/picaf/aegis.git) and internal LAN addresses (192.168.0.50:7719, 192.168.0.146:7717) used as example onboarding strings, indicating an internal tool published to the public registry.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-016660",
            "import_time":  "2026-08-06T18:09:02.593452079Z",
            "modified_time":  "2026-08-06T15:48:23Z",
            "sha256":  "d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00",
            "source":  "amazon-inspector",
            "versions":  [
                "0.3.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @avi892nash/aegis-grid-runner

Package

Name
@avi892nash/aegis-grid-runner
View open source insights on deps.dev
Purl
pkg:npm/%40avi892nash/aegis-grid-runner

Affected ranges

Affected versions

0.*
0.3.3

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "grid.mjs",
            "sha256":  "0bd05b67367efa834c19d728c90fa6ad858941f44403e6b9fd99c8d8c4d29b6b",
            "tlsh":  "4064f74151f62037473350ad1ecb615eb6ea88077d46c870fadcf2583fc7924a6b7aa8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "aegis-grid-runner-0.3.3.tgz",
            "hashes":  {
                "sha1":  "51091cf09eb0e332044127e31cf0b42f5c491476",
                "sha512_sri":  "sha512-gKLZvggl+zy5lsCAGObbDX4FvA/GzDB7OmZSMgl5CzajABWNB+D9blVqr4YqHfM+TOTXz2Q9wgL/M3oz4+t9rg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@avi892nash/aegis-grid-runner/MAL-2026-13429.json"