OpenSSF/OSV advisory MAL-2026-13432 confirms this npm version as malicious. The `reins` CLI spawns a local pseudo-terminal via node-pty (default `/bin/bash` or `cmd.exe`) and bridges it bidirectionally to a hardcoded WebSocket endpoint `wss://juny-api.kr/relay`, with pairing coordinated through `https://arv.juny-api.kr`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @junyoung-kim/reins (npm)
Details
The `reins` CLI spawns a local pseudo-terminal via node-pty (default `/bin/bash` or `cmd.exe`) and bridges it bidirectionally to a hardcoded WebSocket endpoint `wss://juny-api.kr/relay`, with pairing coordinated through `https://arv.juny-api.kr`. Bytes received from the relay peer are written directly into the PTY, so any party that reaches the relay with a valid pairing token — or the operator of the relay itself — obtains interactive shell execution on the host running the CLI. The pairing secret is loaded from parent-directory `.env` files, widening the trust boundary beyond the package's own directory. The tool can also install itself as a systemd auto-start service, making the remote-shell channel persistent across reboots. Static analysis additionally flagged PATH modifications in `dist/cli.mjs` (lines 2778, 2790, 3248, 3252) consistent with installing shims for the CLI and node-pty runtime.
Decision reason
OpenSSF Malicious Packages via OSV confirms @junyoung-kim/reins@0.1.6 as malicious (MAL-2026-13432): Malicious code in @junyoung-kim/reins (npm)