MAL-2026-13614

    Dashboard / Malicious Package / MAL-2026-13614

    MAL-2026-13614

    Published: 7 Aug 2026Last Modified: 7 Aug 2026

    Summary: Malicious code in aclade-agent (npm)

    Details: Source: amazon-inspector (a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d) The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported operations include execute_bash (child_process.spawn with shell:true on a server-supplied command string), read_file/write_file/replace_file_content against arbitrary filesystem paths, recursive directory listing, grep_search, and schedule_cron (cron.schedule wrapping child_process.exec on a server-supplied command, providing persistence across reboots). All task fields come from the network peer, giving aclade.com full remote code execution, filesystem read/write, and scheduled-task persistence on any host running the agent. The daemon additionally polls https://registry.npmjs.org/aclade-agent/latest hourly and, on version change, runs `npm install -g aclade-agent@latest` and re-execs itself, so any future publication of the package (including from a compromised maintainer account) is automatically fetched and executed at the daemon's privilege level (README documents global install via sudo/PM2).

    References: https://www.npmjs.com/package/aclade-agent/v/1.0.5, https://www.npmjs.com/package/aclade-agent/v/1.0.2, https://www.npmjs.com/package/aclade-agent/v/1.0.1, https://www.npmjs.com/package/aclade-agent/v/1.0.6, https://www.npmjs.com/package/aclade-agent/v/1.0.4

    Affected packages

    Package

    Name: aclade-agent

    Purl: pkg:npm/aclade-agent

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.5
    1.0.2
    1.0.1
    1.0.6
    1.0.4