MAL-2026-13614

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aclade-agent/MAL-2026-13614.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13614
Published
2026-08-07T16:37:54Z
Modified
2026-08-07T17:04:53.386938849Z
Summary
Malicious code in aclade-agent (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d)

The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported operations include executebash (childprocess.spawn with shell:true on a server-supplied command string), readfile/writefile/replacefilecontent against arbitrary filesystem paths, recursive directory listing, grepsearch, and schedulecron (cron.schedule wrapping child_process.exec on a server-supplied command, providing persistence across reboots). All task fields come from the network peer, giving aclade.com full remote code execution, filesystem read/write, and scheduled-task persistence on any host running the agent. The daemon additionally polls https://registry.npmjs.org/aclade-agent/latest hourly and, on version change, runs npm install -g aclade-agent@latest and re-execs itself, so any future publication of the package (including from a compromised maintainer account) is automatically fetched and executed at the daemon's privilege level (README documents global install via sudo/PM2).

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T16:38:02Z",
            "source": "amazon-inspector",
            "sha256": "228b5c0bac20b8667155520d95e946b292167cd04c0fb9bf244d6f66200332ea",
            "import_time": "2026-08-07T16:51:15.26964435Z",
            "id": "IN-MAL-2026-017116",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "modified_time": "2026-08-07T16:38:16Z",
            "source": "amazon-inspector",
            "sha256": "46cdbc08753740ec1f23b0cb77a400e67741099c0c8cc743c4a86cb61ec6fd0b",
            "import_time": "2026-08-07T16:51:15.375056687Z",
            "id": "IN-MAL-2026-017117",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "modified_time": "2026-08-07T16:38:25Z",
            "source": "amazon-inspector",
            "sha256": "8ef6554961bfa0fd7794f383f3d385cb79bf4ac1af60598343e782142d2e7058",
            "import_time": "2026-08-07T16:51:15.509021266Z",
            "id": "IN-MAL-2026-017118",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "modified_time": "2026-08-07T16:37:54Z",
            "source": "amazon-inspector",
            "sha256": "a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d",
            "import_time": "2026-08-07T16:51:15.097026436Z",
            "id": "IN-MAL-2026-017115",
            "versions": [
                "1.0.6"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-07T16:38:39Z",
            "sha256": "d8babf2ddba443878ed2357fc1991d98d268b775a9014ba8ad00d8d753ee4921",
            "import_time": "2026-08-07T16:51:15.605103596Z",
            "id": "IN-MAL-2026-017119",
            "versions": [
                "1.0.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / aclade-agent

Package

Name
aclade-agent
View open source insights on deps.dev
Purl
pkg:npm/aclade-agent

Affected ranges

Affected versions

1.*
1.0.1
1.0.2
1.0.4
1.0.5
1.0.6

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "aclade-agent-1.0.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-Ea37sT9s2SAuN4xIz5ytFh60mTMiJwp3driuC3SAOG19xqGdcAR7LNRj4oQStPN3cCLahbTWBNuJFOD/gg7Mxg==",
                "sha1": "5a50763b000bda771d7e0d3ffadda52a20523d3b"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "4832a71569fb503142b3b4ba6b4f9405b67aa003230cdda4be0ce3586f8543493fabed",
            "sha256": "e8c8e5d8543c3306752eccbc484ed0b0e3d7e5717251f8cdcad431fab646ba5c",
            "path": "dist/index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aclade-agent/MAL-2026-13614.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]