⌘ + K

MAL-2026-13733

Dashboard / Malicious Package / MAL-2026-13733

MAL-2026-13733

Published: 11 Aug 2026Last Modified: 11 Aug 2026

Summary: Malicious code in newtun (npm)

Details: Source: amazon-inspector (adc90e76cf26bdb3145704cfb477f3a5215670556d03ff2959dde595a8bb0598) The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete control of the installer's host. On TERM_OPEN messages the client calls pty.spawn(shell,...) and pipes server-supplied bytes (base64-decoded) directly into term.write(), giving the remote server an interactive PTY shell as the process user. SCRIPT_LIST/POLICY_SCRIPTS messages pass server-controlled string content to child_process.exec() and return stdout/stderr/exit code back over the same socket. FILE_REQUEST messages dispatch fs.readdirSync / readFileSync / writeFileSync / unlinkSync / rmSync / renameSync / mkdirSync against server-supplied paths, with file contents shipped back base64-encoded (up to 10MB per read) — allowing the operator to exfiltrate ~/.ssh, ~/.aws, and other installer secrets and to plant or delete files anywhere the process user can write. Every 5 seconds the client also sends MONITOR frames carrying hostname, OS type/release, arch, Node version, CPU/memory/load, uptime, and /proc/net/dev RX/TX rates; the initial authenticate frame carries os.hostname(), os.type/release/arch, and process.version. An UPGRADE control message causes the client to run `npm update -g newtun` and relaunch, letting the remote server swap the globally installed binary for any future published version without user interaction. The transport is unauthenticated plain ws:// so any on-path party can also drive these primitives.

Affected packages

Package

Name: newtun

Purl: pkg:npm/newtun

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

1.0.20

1.0.14

1.0.18

1.0.25

1.0.12

1.0.26

1.0.21

1.0.1

1.0.13

1.0.8

1.0.27

1.0.16

1.0.24

1.0.11

1.0.17

1.0.23

1.0.19

1.0.2

1.0.0

1.0.3

1.0.15

1.0.22