MAL-2026-13432

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@junyoung-kim/reins/MAL-2026-13432.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13432
Published
2026-08-06T16:53:28Z
Modified
2026-08-06T23:50:01.117567751Z
Summary
Malicious code in @junyoung-kim/reins (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475)

The reins CLI spawns a local pseudo-terminal via node-pty (default /bin/bash or cmd.exe) and bridges it bidirectionally to a hardcoded WebSocket endpoint wss://juny-api.kr/relay, with pairing coordinated through https://arv.juny-api.kr. Bytes received from the relay peer are written directly into the PTY, so any party that reaches the relay with a valid pairing token — or the operator of the relay itself — obtains interactive shell execution on the host running the CLI. The pairing secret is loaded from parent-directory .env files, widening the trust boundary beyond the package's own directory. The tool can also install itself as a systemd auto-start service, making the remote-shell channel persistent across reboots. Static analysis additionally flagged PATH modifications in dist/cli.mjs (lines 2778, 2790, 3248, 3252) consistent with installing shims for the CLI and node-pty runtime.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475",
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T16:53:28Z",
            "versions": [
                "0.1.7"
            ],
            "import_time": "2026-08-06T18:09:13.39898324Z",
            "id": "IN-MAL-2026-016740"
        },
        {
            "sha256": "b67a86025d39aab07f1c67ee5f3a6d638d024cc63ca54fddbe0087ea3a9ff26d",
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T16:53:38Z",
            "versions": [
                "0.1.6"
            ],
            "import_time": "2026-08-06T18:09:13.522373173Z",
            "id": "IN-MAL-2026-016741"
        }
    ]
}
References
Credits

Affected packages

npm / @junyoung-kim/reins

Package

Name
@junyoung-kim/reins
View open source insights on deps.dev
Purl
pkg:npm/%40junyoung-kim/reins

Affected ranges

Affected versions

0.*
0.1.6
0.1.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "270033a4b85c05d274a78669145bad6f885fa561",
                "sha512_sri": "sha512-js066zDMxB3v/81dyir/PhyCNnshNGHEEpfgdwUZO0iqhq6tZ/UIGta8fAzHRtc7GNFDoGLz5gDT2dGDs79isQ=="
            },
            "filename": "reins-0.1.7.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/cli.mjs",
            "sha256": "be67e50f643f3166837a07f30efd2db686c10b8ed66582d0c42db18f9a441099",
            "tlsh": "f0940a556afb20725463a0be2f1ba112b225a00b360add587fac56d45f4c53d82f3bfc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@junyoung-kim/reins/MAL-2026-13432.json"