MAL-2026-15902

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/peertube-plugin-video-views-counter/MAL-2026-15902.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15902
Published
2026-09-04T03:45:26Z
Modified
2026-09-04T04:30:05.851502780Z
Summary
Malicious code in peertube-plugin-video-views-counter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde)

plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'd, executing whenever PeerTube loads the plugin module. The same file registers a POST /cmd route on the plugin's HTTP router that passes a caller-supplied cmd field directly to child_process.exec with shell '/bin/bash' and returns stdout/stderr, with no authentication or allowlist. The reverse-shell code is labeled as a background sync worker (keeps view history storage warm) and its function is named connect, but performs no view-counting work. Together these give the remote host at 45.137.222.44 and any HTTP client able to reach the plugin router full interactive shell access on the PeerTube server.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T04:21:20.804009629Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ],
            "id": "IN-MAL-2026-019450",
            "modified_time": "2026-09-04T03:45:26Z",
            "sha256": "f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde"
        }
    ]
}
References
Credits

Affected packages

npm / peertube-plugin-video-views-counter

Package

Name
peertube-plugin-video-views-counter
View open source insights on deps.dev
Purl
pkg:npm/peertube-plugin-video-views-counter

Affected ranges

Affected versions

1.*
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/peertube-plugin-video-views-counter/MAL-2026-15902.json"
indicators 
{
    "evidence_files": [
        {
            "path": "plugin.js",
            "tlsh": "a241522b5ce4a11207b7f078a95f0806f927a103295f9aa9be5ec3104f4607c416ffe9",
            "sha256": "3c696654159d4dbe0d538f846ee6e7c8bb72ba4f150cff68e16eb49491181ca2"
        }
    ],
    "package_integrity": [
        {
            "filename": "peertube-plugin-video-views-counter-1.0.2.tgz",
            "hashes": {
                "sha1": "ebec3286d4ccf840f481929fc8124179e2901099",
                "sha512_sri": "sha512-AjHK2J26WvyceRG3dDecF1fuGx6fkoNw12cEmRmj7UC3x9J6zVTN6xyaMpDLyF07g2y+kGP8oULFARV+ahzh0g=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]