kalipto-runtime @1.0.0

Summary

The package's main entry (src/server.js) is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes the request body's command field directly to child_process.exec with a 30-second timeout. The endpoint is gated by an API key read from process.env.RUNTIME_API_KEY, but the package's tarball includes a.env file containing RUNTIME_API_KEY=kalipto_runtime_secret_123 — a shared secret known to anyone who downloads the package from npm. Because main points at this server, both npm start and require('kalipto-runtime') cause the listener to come up. Any installer who runs this package exposes an internet-reachable arbitrary-command-execution service to every network their host is attached to, authenticated by a publicly known key. This is a backdoor: any attacker with the package contents (i.e., anyone) can run arbitrary shell commands on any host running the package.

Source: amazon-inspector (a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a)