Malicious code in elephant-tusk-runner (npm)

The npm package elephant-tusk-runner was found to contain malicious code in its server.js file. The package starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0.0.0, with fully open CORS (Access-Control-Allow-Origin: *) and no authentication.\n\nThe server exposes multiple dangerous endpoints: a WebSocket route /terminal-stream and HTTP POST /api/v1/workspace-terminal-command that spawn bash or powershell.exe PTY and pipe network-received bytes directly into the PTY session, giving any peer that can reach port 4201 an interactive shell on the host. Additional endpoints call child_process.exec with attacker-controllable arguments, including git clone, composer install, npm install, PHP execution, and process termination commands, plus a fetch-proxy that forwards arbitrary target URLs.\n\nThe listener is started by npm start and by the tusk/elephant CLI shipped in the package's bin entries. On any developer or build machine on a shared or reachable network, this exposes a full remote-shell and remote-code-execution surface for the duration the tool runs.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.