MAL-2026-10709

    Dashboard / Malicious Package / MAL-2026-10709

    MAL-2026-10709

    Published: 16 Jul 2026Last Modified: 16 Jul 2026

    Summary: Malicious code in @cyberrant-rantai/rantai (npm)

    Details: Source: amazon-inspector (41d1dbf6fb83f9a7c4c4b94ee40255e86910714400e249fec55b031e809c92bd) runtime/local_agent.py opens a Socket.IO client connection to a hardcoded server at https://app.cyberrant.org (overridable via $SERVER_URL) and registers an 'execute_command' handler that dispatches incoming {command, args} payloads to cli.task_executor.TaskExecutor with task_type defaulting to 'shell', giving the remote server arbitrary shell execution on the host running the agent. runtime/cli/web_connector.py enrolls the CLI itself against CYBERRANT_WS_URL (default https://api.cyberrant.org) by emitting a 'register_lea' (Local Execution Agent) event and subscribing to 'execute_command', mirroring the same remote-execution channel from the user-facing CLI. Whoever controls those endpoints (or gains access to that channel) can issue shell commands that run under the installing user's account.

    References: https://www.npmjs.com/package/@cyberrant-rantai/rantai/v/1.0.15

    Affected packages

    Package

    Name: @cyberrant-rantai/rantai

    Purl: pkg:npm/%40cyberrant-rantai/rantai

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.15
    MAL-2026-10709 | CVE-DB