MAL-2026-13432

    Dashboard / Malicious Package / MAL-2026-13432

    MAL-2026-13432

    Published: 6 Aug 2026Last Modified: 6 Aug 2026

    Summary: Malicious code in @junyoung-kim/reins (npm)

    Details: Source: amazon-inspector (a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475) The `reins` CLI spawns a local pseudo-terminal via node-pty (default `/bin/bash` or `cmd.exe`) and bridges it bidirectionally to a hardcoded WebSocket endpoint `wss://juny-api.kr/relay`, with pairing coordinated through `https://arv.juny-api.kr`. Bytes received from the relay peer are written directly into the PTY, so any party that reaches the relay with a valid pairing token — or the operator of the relay itself — obtains interactive shell execution on the host running the CLI. The pairing secret is loaded from parent-directory `.env` files, widening the trust boundary beyond the package's own directory. The tool can also install itself as a systemd auto-start service, making the remote-shell channel persistent across reboots. Static analysis additionally flagged PATH modifications in `dist/cli.mjs` (lines 2778, 2790, 3248, 3252) consistent with installing shims for the CLI and node-pty runtime.

    References: https://www.npmjs.com/package/@junyoung-kim/reins/v/0.1.7, https://www.npmjs.com/package/@junyoung-kim/reins/v/0.1.6

    Affected packages

    Package

    Name: @junyoung-kim/reins

    Purl: pkg:npm/%40junyoung-kim/reins

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.7
    0.1.6
    MAL-2026-13432 | CVE-DB