0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
kalipto-local
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting kalipto-local, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5922 | Unknown | Malicious code in @kalipto/local (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f887073dda96085d83a06048f0010c3e6bef58c035579649a0f1ae6cad66828f) The package is a purpose-built remote-control agent. On startup (when the bin is invoked with `--token`, e.g. `npx @kalipto/local --token...`), index.js opens a plaintext WebSocket connection to ws://api.kaliptosal.dev:3001 and sends a register message containing the host's `process.env.HOSTNAME`, `process.platform`, and the supplied token (index.js:27-34). It then listens for messages of type `command` and executes the attached shell strin |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f887073dda96085d83a06048f0010c3e6bef58c035579649a0f1ae6cad66828f) The package is a purpose-built remote-control agent. On startup (when the bin is invoked with `--token`, e.g. `npx @kalipto/local --token...`), index.js opens a plaintext WebSocket connection to ws://api.kaliptosal.dev:3001 and sends a register message containing the host's `process.env.HOSTNAME`, `process.platform`, and the supplied token (index.js:27-34). It then listens for messages of type `command` and executes the attached shell strin