Malicious code in @kyronixai/executer (npm)
The npm package @kyronixai/executer version 1.0.5 contains malicious code that opens a WebSocket connection to a hardcoded external server. This connection allows remote parties to send commands that the package executes on the host system, including arbitrary shell commands and filesystem operations such as reading, writing, deleting, moving, copying files, and creating directories. There is no cryptographic authentication of these commands, and the remote server is a personal domain unrelated to the package scope, enabling full remote control of any machine running this package version.
AI Analysis
Technical Summary
The @kyronixai/executer npm package version 1.0.5 exposes a critical security risk by connecting to a hardcoded WebSocket endpoint (wss://kyronix.harshitnakrani.me/ws/executer). Incoming 'execution:request' messages from this endpoint are dispatched to executors that perform shell command execution via child_process.exec and various filesystem operations on the host machine. The lack of authentication on the WebSocket commands and the use of a personal domain for the server indicate malicious intent, allowing any party able to reach the WebSocket server to execute arbitrary code and manipulate the filesystem on the host.
Potential Impact
Any system running @kyronixai/executer version 1.0.5 is vulnerable to remote code execution and arbitrary filesystem manipulation by an attacker controlling or able to access the hardcoded WebSocket server. This can lead to full compromise of the host system, data theft, destruction, or further lateral movement within the environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove or avoid using @kyronixai/executer version 1.0.5. Since the package connects to an untrusted external server without authentication, it should be considered malicious and untrusted. Check the vendor or package repository for updates or advisories. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in @kyronixai/executer (npm)
Description
The npm package @kyronixai/executer version 1.0.5 contains malicious code that opens a WebSocket connection to a hardcoded external server. This connection allows remote parties to send commands that the package executes on the host system, including arbitrary shell commands and filesystem operations such as reading, writing, deleting, moving, copying files, and creating directories. There is no cryptographic authentication of these commands, and the remote server is a personal domain unrelated to the package scope, enabling full remote control of any machine running this package version.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @kyronixai/executer npm package version 1.0.5 exposes a critical security risk by connecting to a hardcoded WebSocket endpoint (wss://kyronix.harshitnakrani.me/ws/executer). Incoming 'execution:request' messages from this endpoint are dispatched to executors that perform shell command execution via child_process.exec and various filesystem operations on the host machine. The lack of authentication on the WebSocket commands and the use of a personal domain for the server indicate malicious intent, allowing any party able to reach the WebSocket server to execute arbitrary code and manipulate the filesystem on the host.
Potential Impact
Any system running @kyronixai/executer version 1.0.5 is vulnerable to remote code execution and arbitrary filesystem manipulation by an attacker controlling or able to access the hardcoded WebSocket server. This can lead to full compromise of the host system, data theft, destruction, or further lateral movement within the environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove or avoid using @kyronixai/executer version 1.0.5. Since the package connects to an untrusted external server without authentication, it should be considered malicious and untrusted. Check the vendor or package repository for updates or advisories. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12505
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a73573bbf8831d539152f09
Added to database: 08/05/2026, 15:31:07 UTC
Last enriched: 08/05/2026, 16:49:14 UTC
Last updated: 08/05/2026, 16:49:14 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.