@ccr-wer/dsh-remote-rea

When no global rea exists, analyze flows execute `npx --yes rea-agents@latest ...` on the target host as the SSH user. npx auto-confirms and resolves @latest from the public registry at runtime, so a compromised or newly-published malicious version executes arbitrary code on the remote host with the connecting user's privileges.

The agent supplies an arbitrary environment-variable name and the plugin copies its value into a stored SSH password. By adding a host pointing at an attacker-controlled server with authKind=password and passwordEnv=<some-secret>, then calling test/fetch, the secret value is sent to the attacker's SSH server during password authentication — a covert exfiltration channel for any process environment variable.

runFetch/runAnalyze use the raw alias argument in the report filename without applying ALIAS_RE, and finish() writes a report even when the alias is unknown. If writeJsonReport does not sanitise its filename argument (unharvested), an alias containing '../' could write JSON outside reportsDir. Depends on unverified code, hence low.

Host entries include auth.password and auth.passphrase and are persisted verbatim to ~/.reverse/remote-ssh-hosts.json. Mode 0600 mitigates but any same-user process or backup can read cleartext credentials; the plugin deliberately avoids exposing passwords in tool output, yet stores them readable on disk.

If an attacker can influence the host process environment, they can point REVERSE_SSH2_MODULE at a malicious module that is require()d on the first SSH connection, yielding code execution. Reachability requires control of the process environment, so impact is limited.