{"answers":{"affected":"1 open source package ship an affected version, including elephant-tusk-runner.","exploited":"There is no known exploitation of MAL-2026-13445 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13445 is a malicious package in elephant-tusk-runner, published on 6 Aug 2026."},"fix_prompt":"MAL-2026-13445 is a malicious package: elephant-tusk-runner (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13445/ (Markdown: https://insights.sbomify.com/MAL-2026-13445/index.md)","id":"MAL-2026-13445","markdown":"https://insights.sbomify.com/MAL-2026-13445/index.md","name":"MAL-2026-13445","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"server.js starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0.0.0, with fully open CORS (Access-Control-Allow-Origin: *) and no authentication. A WebSocket route /terminal-stream and HTTP POST /api/v1/workspace-terminal-command each spawn a bash or powershell.exe PTY and pipe network-received bytes directly into ptySession.write(...), giving any peer that can reach port 4201 an interactive shell on the host running the tool. Additional endpoints on the same listener call child_process.exec with attacker-controllable arguments, including `git clone --depth=1 ${targetGitUrl}...`, `composer install \u0026\u0026 php artisan key:generate`, `npm install`, `php \"${terminalFile}\"`, and taskkill/kill on arbitrary PIDs, plus a fetch-proxy that forwards arbitrary target URLs. The listener is started by `npm start` and by the `tusk`/`elephant` CLI shipped in the package's bin entries. On any developer or build machine on a shared or reachable network, this exposes a full remote-shell and remote-code-execution surface for the duration the tool runs.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in elephant-tusk-runner (npm)","id":"MAL-2026-13445","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"elephant-tusk-runner","purl":"pkg:npm/elephant-tusk-runner","source":"MAL-2026-13445"}],"products":null,"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13445/"}