MAL-2026-18204 Malicious code in @factiii/runner (npm)

@factiii/runner is a remote-development bridge that pairs the installer's machine with Factiii's mobile/web clients over WebRTC through api.factiii.com, enabling Claude/Codex coding agents to drive tmux sessions and shell commands on the installer's host. The capability is the product and is openly documented in the package description and README. The channel is started only by the user explicitly invoking the factiii-runner start CLI; there is no install or import lifecycle hook that brings it up automatically, and no boot/login persistence is installed. Authentication uses a pairing JWT stored in config.json plus a per-session FACTIII_SECRETS_TOKEN, and the bundled factiii-secrets daemon requires per-command owner authorization before executing (declining with an explicit owner-refused message). The control plane is first-party (api.factiii.com / factiii.com) and not caller-configurable to arbitrary hosts; the embedder binds loopback 127.0.0.1. The dist/cli.js POST patterns correspond to this documented control-plane traffic, and embedder/serve.py's ping/POST/GET surface is a local embedder HTTP server. No credential harvesting from installer secret stores (~/.aws, ~/.ssh, ~/.npmrc, browser profiles, wallet stores), no env-var scraping, no off-host exfiltration of workspace data, and no obfuscated secondary channel were observed. Concerns worth human review are the full-host blast radius inherent to any remote-shell product and the fact that remote peers on the paired channel can drive arbitrary commands within the authorization UX — architecturally expected for this category but worth maintainer disclosure of session scope, idle timeout, and stop semantics.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.