{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/ptyDaemon.cjs",
              "sha256": "bf538f727ef3765886bfd179501e68963cc7f68d235760ba8d8cf1557950e74b",
              "tlsh": "9d02fae6734976ebcbe092618867012095b6be15b405346cf3c4fdef2f205d065eab15"
            },
            {
              "path": "dist/install.cjs",
              "sha256": "36aa466fc8e97547c9813d26e3cdf74acf39b017916ab7a07bf71c91189c2d5f",
              "tlsh": "324165d2178067b92ed0d55aca9e040793784a38142ce0d4e2dcceea29b607603e5f75"
            }
          ],
          "package_integrity": [
            {
              "filename": "9remote-2.1.5.tgz",
              "hashes": {
                "sha1": "30386dc5b5bed37fe38ae28da5d126356282d4d6",
                "sha512_sri": "sha512-CqPGwNoeAogfdgHKhWDKwNkkFcfJ5ZITsgEivZxHH9EcDAD6j4Wz/Dh2qsWGxl4iisu4Bm/352Un7J3YrlYC0w=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "9remote"
      },
      "versions": [
        "2.1.5",
        "2.1.14",
        "2.1.20",
        "2.1.9",
        "2.1.16",
        "2.1.21",
        "2.1.6",
        "2.2.5",
        "2.2.6",
        "2.1.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016372",
        "import_time": "2026-08-06T14:19:45.644247601Z",
        "modified_time": "2026-08-06T13:16:18Z",
        "sha256": "176c0f836027b6464583c707e532c2f8776dc299763837f3d0979aeb34ee34b3",
        "source": "amazon-inspector",
        "versions": [
          "2.1.5"
        ]
      },
      {
        "id": "IN-MAL-2026-016374",
        "import_time": "2026-08-06T14:19:45.757757849Z",
        "modified_time": "2026-08-06T13:16:37Z",
        "sha256": "22a4e5c39f7a943e2cc2baef9292bc7bedd55600bddf5c829dcc8076211fda3b",
        "source": "amazon-inspector",
        "versions": [
          "2.1.14"
        ]
      },
      {
        "id": "IN-MAL-2026-016370",
        "import_time": "2026-08-06T14:19:45.572754581Z",
        "modified_time": "2026-08-06T13:15:58Z",
        "sha256": "4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0",
        "source": "amazon-inspector",
        "versions": [
          "2.1.20"
        ]
      },
      {
        "id": "IN-MAL-2026-016377",
        "import_time": "2026-08-06T14:19:45.997862881Z",
        "modified_time": "2026-08-06T13:17:02Z",
        "sha256": "50ecf084f7adfa9c742234b8137a3725ec71728b254950efe2b630c0e4cf57a8",
        "source": "amazon-inspector",
        "versions": [
          "2.1.9"
        ]
      },
      {
        "id": "IN-MAL-2026-016376",
        "import_time": "2026-08-06T14:19:45.870202528Z",
        "modified_time": "2026-08-06T13:16:53Z",
        "sha256": "7017db3f7480a7357c78587e7d6f5ff85fcd3ccfc316f575fc17e60c20d5c592",
        "source": "amazon-inspector",
        "versions": [
          "2.1.16"
        ]
      },
      {
        "id": "IN-MAL-2026-016369",
        "import_time": "2026-08-06T14:19:45.532558705Z",
        "modified_time": "2026-08-06T13:15:46Z",
        "sha256": "f0c4686e0ed2e8e4e8031eb4cc5618ade0e9be4885039d981132ad9b10637754",
        "source": "amazon-inspector",
        "versions": [
          "2.1.21"
        ]
      },
      {
        "id": "IN-MAL-2026-016373",
        "import_time": "2026-08-06T14:19:45.673756672Z",
        "modified_time": "2026-08-06T13:16:26Z",
        "sha256": "342eab2cbe8adf419d7f9f08116929689111deef4595ce231b52e9e30aaabf1b",
        "source": "amazon-inspector",
        "versions": [
          "2.1.6"
        ]
      },
      {
        "id": "IN-MAL-2026-016378",
        "import_time": "2026-08-06T14:19:46.036006436Z",
        "modified_time": "2026-08-06T13:17:10Z",
        "sha256": "348253e1e3b9ef12096655a25242b519780e85085f1c257c982a61caa64ab020",
        "source": "amazon-inspector",
        "versions": [
          "2.2.5"
        ]
      },
      {
        "id": "IN-MAL-2026-016375",
        "import_time": "2026-08-06T14:19:45.795223461Z",
        "modified_time": "2026-08-06T13:16:45Z",
        "sha256": "47e410f8e3224069a52d658deb957bf5b5038a3b46123071a411f042470109bb",
        "source": "amazon-inspector",
        "versions": [
          "2.2.6"
        ]
      },
      {
        "id": "IN-MAL-2026-016371",
        "import_time": "2026-08-06T14:19:45.600050076Z",
        "modified_time": "2026-08-06T13:16:06Z",
        "sha256": "5dc6eeb1739454cc986c504bdd701856a793eaf823057761fc9133cf5234b3b2",
        "source": "amazon-inspector",
        "versions": [
          "2.1.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0)\n9remote is a remote-shell tool: its CLI launches an HTTP/WebSocket server and provisions a Cloudflare Quick Tunnel that exposes the host to the public internet at a 9remote.cc-fronted URL. Incoming WebSocket `input` messages are forwarded verbatim into a locally spawned PTY (bash/zsh on Unix, cmd.exe/powershell.exe on Windows) via `pty.write(s.data)`, after `spawn(o.path, o.args,...)` in the pty daemon. The server\u0027s router treats requests bearing the `cf-connecting-ip` header as remote-authorized. Access is gated by a short-lived (~30-minute) one-time pair key shown as a QR code; anyone who obtains that key over the tunnel obtains a full interactive shell on the host with the user\u0027s privileges. The package is invoked explicitly by the operator (bin entry, not lifecycle scripts or top-level require side effects), and the tunnel terminates at first-party infrastructure (9remote.cc / Cloudflare), so this is the advertised behavior of the tool rather than a covert channel \u2014 but the blast radius on any host where the CLI is run is full-host remote code execution behind a single short-lived key.\n",
  "id": "MAL-2026-13406",
  "modified": "2026-08-06T14:21:50Z",
  "published": "2026-08-06T13:15:46Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.14"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.20"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.9"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.16"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.21"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.6"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.2.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.2.6"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/9remote/v/2.1.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in 9remote (npm)"
}