The f-termx npm package version 1.2.6 includes embedded malicious functionality that exposes a remote command execution backdoor. It runs an HTTP + Socket.IO server bound to 0.0.0.0, enabling any network peer to send a 'spawn-shell' message that triggers spawning a local /bin/bash pseudo-terminal, forwarding input from the network to the shell process. It also supports a 'connect-ssh' message that opens an SSH session to a specified host using credentials from environment variables or supplied by the attacker, with no authentication on the SSH proxy namespace. The web UI ships with hardcoded default credentials 'admin/admin', further facilitating unauthorized access. The code uses child_process spawn calls to implement these features, confirming the malicious intent.

An attacker who can reach the exposed server can execute arbitrary commands on the host system with the privileges of the running process. This includes spawning a fully interactive shell and establishing SSH connections to other hosts using stored credentials, potentially pivoting within the network. The lack of authentication on the SSH proxy namespace and the use of default web UI credentials allow trivial unauthorized access. This results in a complete compromise of the host running the f-termx package version 1.2.6.

No official patch or remediation is currently documented. Users should immediately remove the f-termx package version 1.2.6 from their environments and avoid using it. Since this is a malicious package, do not run or expose it to any network. Monitor for any instances of this package in your supply chain and replace with trusted alternatives. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.