GCVE-110-OSM-2026-10258

The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete control of the installer's host. On TERM_OPEN messages the client calls pty.spawn(shell,...) and pipes server-supplied bytes (base64-decoded) directly into term.write(), giving the remote server an interactive PTY shell as the process user. SCRIPT_LIST/POLICY_SCRIPTS messages pass server-controlled string content to child_process.exec() and return stdout/stderr/exit code back over the same socket. FILE_REQUEST messages dispatch fs.readdirSync / readFileSync / writeFileSync / unlinkSync / rmSync / renameSync / mkdirSync against server-supplied paths, with file contents shipped back base64-encoded (up to 10MB per read) — allowing the operator to exfiltrate ~/.ssh, ~/.aws, and other installer secrets and to plant or delete files anywhere the process user can write. Every 5 seconds the client also sends MONITOR frames carrying hostname, OS type/release, arch, Node version, CPU/memory/load, uptime, and /proc/net/dev RX/TX rates; the initial authenticate frame carries os.hostname(), os.type/release/arch, and process.version. An UPGRADE control message causes the client to run `npm update -g newtun` and relaunch, letting the remote server swap the globally installed binary for any future published version without user interaction. The transport is unauthenticated plain ws:// so any on-path party can also drive these primitives.