@avi892nash/aegis-grid-runner @0.3.3

Summary

The package's default bin action starts an HTTP server (grid.mjs) that listens on GRID_RUNNER_PORT (default 7719). Incoming requests carry a base64-JSON x-job-meta header containing a cmd string plus a gzipped code tarball; the runner decodes the header, extracts the tarball, and invokes child_process.spawn on meta.cmd in a shell on the host running the runner. The runner boots unpaired by default and accepts pairing via POST /api/master ; token authentication (GRID_TOKEN) is optional per README, so a peer able to reach the port can pair and drive arbitrary shell command execution on the host. The bundle also contains references to internal Juspay infrastructure ( ssh://git@ssh.bitbucket.juspay.net/picaf/aegis.git ) and internal LAN addresses (192.168.0.50:7719, 192.168.0.146:7717) used as example onboarding strings, indicating an internal tool published to the public registry.

Source: amazon-inspector (d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00)