MAL-2026-15817

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/peertube-plugin-poc-marker/MAL-2026-15817.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15817
Published
2026-09-02T03:58:06Z
Modified
2026-09-02T04:30:05.680904704Z
Summary
Malicious code in peertube-plugin-poc-marker (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ff307f6227ac4a9217a899b419a6931ddfe0376cb0cc6ba3570c0f589247241c)

index.js runs id; uname -a; hostname; date -u; ls -d /var/www/peertube via execSync when PeerTube invokes the plugin's register() hook, then POSTs the combined stdout as JSON to the hardcoded bare-IP collector http://103.38.237.204:8444/poc over plaintext HTTP. The same reconnaissance output is also written into a poc_proof plugin setting registered with private: false, providing a second read-back channel via the PeerTube public settings API. The destination host is not configurable, is unrelated to the plugin's declared PeerTube purpose, and captures the host's user, kernel, hostname, and PeerTube install path from the server on which the plugin is loaded.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-02T04:23:33.662929457Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-019331",
            "modified_time": "2026-09-02T03:58:06Z",
            "sha256": "ff307f6227ac4a9217a899b419a6931ddfe0376cb0cc6ba3570c0f589247241c"
        }
    ]
}
References
Credits

Affected packages

npm / peertube-plugin-poc-marker

Package

Name
peertube-plugin-poc-marker
View open source insights on deps.dev
Purl
pkg:npm/peertube-plugin-poc-marker

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/peertube-plugin-poc-marker/MAL-2026-15817.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "8c3153da51f8a379dbc2b4fcf24b11525223e24e26048d95f2dc17702b0f5a882b1af4",
            "sha256": "6a8ed05fac49ed2ad33c8cd12475fba50bdd971e3daa0ce8d50129e51f4edd7b"
        }
    ],
    "package_integrity": [
        {
            "filename": "peertube-plugin-poc-marker-1.0.0.tgz",
            "hashes": {
                "sha1": "f87067de5e84faa63af0b5186a9ed6c616c78a5f",
                "sha512_sri": "sha512-/UX0eWTUFp4x7536CGAlZqNG8m/TrVBlHkJkqG2k9H8NRL+lf3XrwodIEQTdVFSC8sFXM/sN9lz7uDe5V7GWsw=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]