@junyoung-kim/reins @0.1.7

Summary

The reins CLI spawns a local pseudo-terminal via node-pty (default /bin/bash or cmd.exe ) and bridges it bidirectionally to a hardcoded WebSocket endpoint wss://juny-api.kr/relay , with pairing coordinated through https://arv.juny-api.kr . Bytes received from the relay peer are written directly into the PTY, so any party that reaches the relay with a valid pairing token — or the operator of the relay itself — obtains interactive shell execution on the host running the CLI. The pairing secret is loaded from parent-directory .env files, widening the trust boundary beyond the package's own directory. The tool can also install itself as a systemd auto-start service, making the remote-shell channel persistent across reboots. Static analysis additionally flagged PATH modifications in dist/cli.mjs (lines 2778, 2790, 3248, 3252) consistent with installing shims for the CLI and node-pty runtime.

Source: amazon-inspector (a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475)