MAL-2026-13614

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d) The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported operations include execute_bash (child_process.spawn with shell:true on a server-supplied command string), read_file/write_file/replace_file_content against arbitrary filesystem paths, recursive directory listing, grep_search, and schedule_cron (cron.schedule wrapping child_process.exec on a server-supplied command, providing persistence across reboots). All task fields come from the network peer, giving aclade.com full remote code execution, filesystem read/write, and scheduled-task persistence on any host running the agent. The daemon additionally polls https://registry.npmjs.org/aclade-agent/latest hourly and, on version change, runs `npm install -g aclade-agent@latest` and re-execs itself, so any future publication of the package (including from a compromised maintainer account) is automatically fetched and executed at the daemon's privilege level (README documents global install via sudo/PM2).