MAL-2026-13429
Malicious code in @avi892nash/aegis-grid-runner (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00) The package's default `bin` action starts an HTTP server (grid.mjs) that listens on GRID_RUNNER_PORT (default 7719). Incoming requests carry a base64-JSON `x-job-meta` header containing a `cmd` string plus a gzipped code tarball; the runner decodes the header, extracts the tarball, and invokes `child_process.spawn` on `meta.cmd` in a shell on the host running the runner. The runner boots unpaired by default and accepts pairing via `POST /api/master`; token authentication (GRID_TOKEN) is optional per README, so a peer able to reach the port can pair and drive arbitrary shell command execution on the host. The bundle also contains references to internal Juspay infrastructure (`ssh://git@ssh.bitbucket.juspay.net/picaf/aegis.git`) and internal LAN addresses (192.168.0.50:7719, 192.168.0.146:7717) used as example onboarding strings, indicating an internal tool published to the public registry.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @avi892nash/aegis-grid-runner (npm). Pin to a known-safe version or switch to an alternative.