9remote is a remote-shell tool that exposes a host to the public internet via a Cloudflare Quick Tunnel. It allows incoming WebSocket input messages to be forwarded directly into a local shell, granting full interactive shell access to anyone possessing a short-lived one-time key. This behavior is by design, not a covert channel, but it results in full-host remote code execution with the user's privileges on any host running the CLI. Multiple specific versions of 9remote (npm) are affected.