Malicious code in @avi892nash/aegis-grid-runner (npm)
The npm package @avi892nash/aegis-grid-runner contained malicious code that starts an unauthenticated HTTP server accepting arbitrary shell commands via a base64-JSON header, enabling remote code execution on the host. The package appears to be an internal Juspay tool accidentally published to the public registry.
- Disclosed
- Last updated
- Blast radius
- Any host running the @avi892nash/aegis-grid-runner package with the default bin action enabled; remote code execution possible from any network peer able to reach the listening port.
- Ecosystems
- Attack vectors
- Affected entities
- @avi892nash/aegis-grid-runnernpm package containing malicious code
The npm package @avi892nash/aegis-grid-runner was published to the public registry containing malicious code. When the package's default bin action is invoked, it starts an HTTP server (grid.mjs) listening on port GRID_RUNNER_PORT (default 7719).\n\nThe server accepts incoming requests with a base64-JSON x-job-meta header containing a cmd string and a gzipped code tarball. The runner decodes the header, extracts the tarball, and executes the command via child_process.spawn in a shell on the host. Token authentication (GRID_TOKEN) is optional per the README, meaning any network peer able to reach the port can pair with the server and drive arbitrary shell command execution.\n\nThe package bundle contains references to internal Juspay infrastructure, including git repository URLs (ssh://git@ssh.bitbucket.juspay.net/picaf/aegis.git) and internal LAN addresses (192.168.0.50:7719, 192.168.0.146:7717), indicating this was an internal tool accidentally published to the public npm registry.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @avi892nash/aegis-grid-runner
Remediation
- Immediately uninstall @avi892nash/aegis-grid-runner from all systems
- Audit systems that installed this package for signs of unauthorized access or command execution
- Review network logs for connections to port 7719 or other GRID_RUNNER_PORT values
- If the package was installed, assume the host may be compromised and perform a full security audit
- Do not install or use this package; it should not be used in any environment
Sources
- GitHub Advisory GHSA-w7r2-hmcm-cv9x · GitHub Advisory Database
Cite this entry
"Malicious code in @avi892nash/aegis-grid-runner (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-avi892nash-aegis-grid-runner-npm-1wgc9z
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @zynkit/probe
Malware discovered in the npm package @zynkit/probe. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in club-sauce
Malware discovered in the npm package club-sauce. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in awesome-ts-jest
Malware was discovered in the npm package awesome-ts-jest. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in arc-diag-util
The npm package arc-diag-util was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys should be rotated immediately from a different machine, and the package should be removed.
npmCompromised package