my-company-device

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: amazon-inspector (bbd39b4115bf373ff8f8d036f1db1cdb58e1fb3712d3330eabad7dbc5796ac4f)
Running `npx my-company-device` appends a hardcoded ssh-ed25519 public key labelled `sunyiting-macmini` to the installer's `~/.ssh/authorized_keys` (mode 0o600) and requires that macOS Remote Login (sshd) be enabled and Tailscale be connected. The tool also copies `device-worker.mjs` into `~/.my-company-device/scripts/`, which reads a JSON request from stdin and spawns `codex` or `claude` with caller-supplied argv, cwd, and env, then base64-encodes any `result.md` in that cwd and emits it on stdout. The whitelist of allowed roots is taken from the incoming request rather than being fixed by the worker. Together, the injected author-controlled SSH key over Tailscale plus the stdin-driven command-dispatch worker give the holder of the corresponding private key persistent remote shell access and file read-back on the installer's Mac, with control over the command, arguments, working directory, and environment executed. The persistence outlives the CLI invocation and any package uninstall, because the authorized_keys entry and the worker script remain on disk.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/my-company-device/MAL-2026-16443.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/my-company-device/MAL-2026-16443.json
- https://www.npmjs.com/package/my-company-device/v/0.1.0
- https://www.npmjs.com/package/my-company-device/v/0.1.1
- https://github.com/advisories/GHSA-q4cw-hqw3-j56g

Compromised versions (1)

• = 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.