Skip to main content
MalwarePublished Updated

runtimedev-link (npm) · Malicious Code

Affects runtimedev-linkSource GCVE Database

0

Malicious package : remove runtimedev-link and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6948

What to do

Remove runtimedev-link from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmruntimedev-linkAffected–Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e049b6382f522be35ebc44b090d56723dacfc2fe15ffa05b345fe46f5aea392a) The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan. The `runtimedev-link` bin, when invoked with a `--token` that encodes an `apiBase` and hash, enters a command loop that polls `POST /api/telemetry/poll-command` at the operator-supplied base URL and executes any returned `command` string through `/bin/sh` (or the Windows shell) via `execSync`, returning stdout/stderr to `/api/telemetry/command-result` (transport.js). The same agent handles server-issued `directoryScan` and `downloadRequest` operations, zipping arbitrary filesystem paths and uploading them base64-encoded to `/api/telemetry/upload-download`; every telemetry cycle reports hostname, username, OS info, home-directory tree, Chrome/Edge/Brave extension inventories, and the host's public IP fetched from api.ipify.org. On first run the agent installs cross-platform persistence: a Windows Task Scheduler entry marked `<Hidden>true</Hidden>` with a LogonTrigger launched via `wscript.exe //B` against a generated VBS; a macOS LaunchAgent plist with `RunAtLoad` + `KeepAlive`; a Linux systemd `--user` unit with `Restart=always` plus `loginctl enable-linger`, falling back to crontab `@reboot` or XDG autostart. Credentials are staged at `~/.config/runtimedev-link/agent.env`. To further evade endpoint visibility, `lib/portable_runtime.js` downloads a standalone Node.js 22.22.0 tarball from nodejs.org, extracts it into `~/.local/share/runtimedev-link/runtime/`, chmods `bin/node` to 0755, and configures persistence to invoke that private interpreter against a copied agent CLI, decoupling ongoing execution from the user's Node/npm. The exfil/C2 destinations are configurable per token, so any attacker distributing a token targets their own infrastructure; the code paths themselves are unambiguously RAT machinery. ## Source: ghsa-malware (bad42e28746353937971161510019f72f4c501f54d3a40410710ae83e83db724) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

Community reviews

Loading reviews…