🛡️ MAL-2026-13432 — reins

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Malicious code in @junyoung-kim/reins (npm)

Source: amazon-inspector

The reins CLI spawns a local pseudo-terminal via node-pty (default /bin/bash or cmd.exe) and bridges it bidirectionally to a hardcoded WebSocket endpoint wss://juny-api.kr/relay, with pairing coordinated through https://arv.juny-api.kr. Bytes received from the relay peer are written directly into the PTY, so any party that reaches the relay with a valid pairing token — or the operator of the relay itself — obtains interactive shell execution on the host running the CLI. The pairing secret is loaded from parent-directory .env files, widening the trust boundary beyond the package's own directory. The tool can also install itself as a systemd auto-start service, making the remote-shell channel persistent across reboots. Static analysis additionally flagged PATH modifications in dist/cli.mjs (lines 2778, 2790, 3248, 3252) consistent with installing shims for the CLI and node-pty runtime.

Affected software

MAL-2026-13432 is recorded against 1 package.

  • @junyoung-kim/reins

Timeline and source

Published on 6 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.npmjs.com (Package)
www.npmjs.com (Package)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-08-06
Updated 2026-08-12
Modified 2026-08-06
Fix URL N/A

Affected Packages

Software From version Fixed in
@junyoung-kim/reins — —

Free Vulnerability Check

Is your site affected by MAL-2026-13432?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-13432 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.