MAL-2026-13429

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@avi892nash/aegis-grid-runner/MAL-2026-13429.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13429
Published
2026-08-06T15:48:23Z
Modified
2026-08-06T23:50:26Z
Summary
Malicious code in @avi892nash/aegis-grid-runner (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00)

The package's default bin action starts an HTTP server (grid.mjs) that listens on GRID_RUNNER_PORT (default 7719). Incoming requests carry a base64-JSON x-job-meta header containing a cmd string plus a gzipped code tarball; the runner decodes the header, extracts the tarball, and invokes child_process.spawn on meta.cmd in a shell on the host running the runner. The runner boots unpaired by default and accepts pairing via POST /api/master; token authentication (GRID_TOKEN) is optional per README, so a peer able to reach the port can pair and drive arbitrary shell command execution on the host. The bundle also contains references to internal Juspay infrastructure (ssh://git@ssh.bitbucket.juspay.net/picaf/aegis.git) and internal LAN addresses (192.168.0.50:7719, 192.168.0.146:7717) used as example onboarding strings, indicating an internal tool published to the public registry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016660",
            "import_time": "2026-08-06T18:09:02.593452079Z",
            "modified_time": "2026-08-06T15:48:23Z",
            "sha256": "d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00",
            "source": "amazon-inspector",
            "versions": [
                "0.3.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @avi892nash/aegis-grid-runner

Package

Name
@avi892nash/aegis-grid-runner
View open source insights on deps.dev
Purl
pkg:npm/%40avi892nash/aegis-grid-runner

Affected ranges

Affected versions

0.*
0.3.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "grid.mjs",
            "sha256": "0bd05b67367efa834c19d728c90fa6ad858941f44403e6b9fd99c8d8c4d29b6b",
            "tlsh": "4064f74151f62037473350ad1ecb615eb6ea88077d46c870fadcf2583fc7924a6b7aa8"
        }
    ],
    "package_integrity": [
        {
            "filename": "aegis-grid-runner-0.3.3.tgz",
            "hashes": {
                "sha1": "51091cf09eb0e332044127e31cf0b42f5c491476",
                "sha512_sri": "sha512-gKLZvggl+zy5lsCAGObbDX4FvA/GzDB7OmZSMgl5CzajABWNB+D9blVqr4YqHfM+TOTXz2Q9wgL/M3oz4+t9rg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@avi892nash/aegis-grid-runner/MAL-2026-13429.json"