Remote Shell Access Vulnerability in my-company-device Package
Summary
MAL-2026-16443: Malicious code in my-company-device (npm). Affects my-company-device versions 0.1.0 – 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The my-company-device package is an npm tool designed for device management and automation on macOS systems. It allows users to execute commands remotely and manage devices efficiently. However, it has been found to contain a serious vulnerability that allows unauthorized remote access to the user's machine.
Vulnerability Detail
The vulnerability originates from the package's functionality that appends a hardcoded SSH public key to the user's authorized_keys file, enabling persistent remote shell access. This occurs when the command 'npx my-company-device' is executed, requiring macOS Remote Login to be enabled and Tailscale connected. The tool also includes a script that reads commands from stdin and executes them with user-supplied parameters, which can lead to arbitrary command execution. The implications of this vulnerability are severe, as it allows an attacker with the corresponding private key to gain control over the affected machine, read files, and execute commands without the user's consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall my-company-deviceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable macOS Remote Login and disconnect Tailscale until the package is updated. Additionally, manually check and remove the hardcoded SSH key from your authorized_keys file.
Conclusion
The my-company-device package contains a critical vulnerability that allows unauthorized remote access to macOS systems. Users are strongly advised to update the package to the latest version and take necessary precautions to secure their systems.
See every vulnerability recorded for my-company-device →
FAQ
my-company-device is an npm package designed for managing devices on macOS, allowing users to execute commands remotely.
The vulnerability allows the package to append a hardcoded SSH public key to the authorized_keys file, granting unauthorized remote access.
An attacker can gain persistent remote access to the user's machine, execute arbitrary commands, and read sensitive files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
As a temporary measure, disable macOS Remote Login and disconnect Tailscale, and manually remove any unauthorized SSH keys from your system.
