rdfxvela @6.2.1

Summary

cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand (signup/login/list/download/deploy), the CLI writes the decoded key to a temp file at mode 0600 and runs ssh -o StrictHostKeyChecking=no -i <key> ubuntu@79.72.65.161 "<cmd>" against the author's signing server. Every recipient of the tarball receives the same key and can log in as ubuntu on 79.72.65.161. Separately, user-entered passwords are interpolated unescaped into the remote shell command line ( bash.../auth.sh signup ${username} ${password} ), exposing them in remote process argv and logs. There are no install-time or import-time lifecycle hooks, no reads of installer secrets or environment variables, no exfiltration of installer-owned data, and no fetching or execution of remote code on the installer's machine. The shared credential authorizes access to a host owned by the package author; the blast radius is confined to the author's own infrastructure.

Source: amazon-inspector (5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911)