OpenSSF/OSV advisory MAL-2026-12505 confirms this npm version as malicious. The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming 'execution:request' messages into a set of executors that run on the installer's host. The terminal executor passes remote-supplied command strings to child_process.exec (via execAsync), and additional handlers register read_file, write_file, delete_file, move_file, copy_file,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @kyronixai/executer (npm)
Details
The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming 'execution:request' messages into a set of executors that run on the installer's host. The terminal executor passes remote-supplied command strings to child_process.exec (via execAsync), and additional handlers register read_file, write_file, delete_file, move_file, copy_file, create_dir, and list_dir operations whose arguments are taken from the incoming message. Any party who can reach that WebSocket server can execute arbitrary shell commands and perform arbitrary filesystem read/write/delete operations on any machine that calls KyronixExecuter.connect(). The destination is a personal domain (harshitnakrani.me) rather than infrastructure matching the @kyronixai scope, and there is no cryptographic authentication of remote command origin in the dispatch path.
Decision reason
OpenSSF Malicious Packages via OSV confirms @kyronixai/executer@1.0.5 as malicious (MAL-2026-12505): Malicious code in @kyronixai/executer (npm)