registry / edwin8600 / 1.3.4

edwin8600@1.3.4

Pasos para publicar en npm

AI Security Review

scanned 8h ago · by lpm-firewall-ai

An administrator-executed PowerShell helper provisions persistent remote SSH access for an embedded third-party key. It also opens SSH to the network and can enroll the machine into a Tailscale tailnet using a bundled auth key.

Static reason

No blocking static signals were detected.

Trigger

User explicitly runs `tailcale/instalar_ssh_servidor.ps1` as Administrator.

Impact

A package author-controlled identity can remotely access the affected Windows account; the device may also join an external Tailscale network.

Mechanism

Installs an embedded SSH authorization key, enables OpenSSH/firewall access, and enrolls Tailscale with a hard-coded key.

Attack narrative

If a victim follows the packaged administrator PowerShell helper, it enables OpenSSH, opens firewall port 22, and writes the embedded `edwin@EDWIN` public key to the victim account's `authorized_keys`. The script additionally offers its bundled Tailscale auth key as the recommended option and runs `tailscale up`, potentially joining the host to the key owner's tailnet. This creates persistent, author-controlled remote-access paths despite having no npm install hook.

Rationale

The package contains an explicit remote-access provisioning script that authorizes a bundled third-party SSH key and default Tailscale enrollment credential. Although it is not install-time, this is concrete persistence and unauthorized remote-access functionality.

Evidence

package.jsontailcale/instalar_ssh_servidor.ps1ware/cdp_recorder.pyware/iniciar_captura.py$env:SystemDrive\Users\$username\.ssh\id_ed25519$env:SystemDrive\Users\$username\.ssh\authorized_keys

edwin8600@1.3.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code