MAL-2026-12505

    Dashboard / Malicious Package / MAL-2026-12505

    MAL-2026-12505

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @kyronixai/executer (npm)

    Details: Source: amazon-inspector (48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297) The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming 'execution:request' messages into a set of executors that run on the installer's host. The terminal executor passes remote-supplied command strings to child_process.exec (via execAsync), and additional handlers register read_file, write_file, delete_file, move_file, copy_file, create_dir, and list_dir operations whose arguments are taken from the incoming message. Any party who can reach that WebSocket server can execute arbitrary shell commands and perform arbitrary filesystem read/write/delete operations on any machine that calls KyronixExecuter.connect(). The destination is a personal domain (harshitnakrani.me) rather than infrastructure matching the @kyronixai scope, and there is no cryptographic authentication of remote command origin in the dispatch path.

    References: https://www.npmjs.com/package/@kyronixai/executer/v/1.0.5

    Affected packages

    Package

    Name: @kyronixai/executer

    Purl: pkg:npm/%40kyronixai/executer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.5
    MAL-2026-12505 | CVE-DB