MAL-2026-13432
Malicious code in @junyoung-kim/reins (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475) The `reins` CLI spawns a local pseudo-terminal via node-pty (default `/bin/bash` or `cmd.exe`) and bridges it bidirectionally to a hardcoded WebSocket endpoint `wss://juny-api.kr/relay`, with pairing coordinated through `https://arv.juny-api.kr`. Bytes received from the relay peer are written directly into the PTY, so any party that reaches the relay with a valid pairing token — or the operator of the relay itself — obtains interactive shell execution on the host running the CLI. The pairing secret is loaded from parent-directory `.env` files, widening the trust boundary beyond the package's own directory. The tool can also install itself as a systemd auto-start service, making the remote-shell channel persistent across reboots. Static analysis additionally flagged PATH modifications in `dist/cli.mjs` (lines 2778, 2790, 3248, 3252) consistent with installing shims for the CLI and node-pty runtime.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @junyoung-kim/reins (npm). Pin to a known-safe version or switch to an alternative.