MAL-2026-16442

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/moudeva/MAL-2026-16442.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16442
Published
2026-09-23T02:44:39Z
Modified
2026-09-23T03:00:06Z
Summary
Malicious code in moudeva (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a)

The package's main.js references child_process at multiple locations (lines 19, 883, 961) alongside HTTP POST calls (lines 365, 369) to a hardcoded endpoint https://ipc.shadxino.internal (referenced at lines 359 and 453). The.internal TLD is not a publicly registrable domain and is consistent with an attacker-controlled or otherwise non-legitimate destination that resolves only in a controlled network context. The co-location of a shell/process-execution primitive with an unconditional POST to a fixed non-standard host inside a single module matches the shape of installer-side command execution and data exfiltration.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020343",
            "import_time":  "2026-09-23T02:46:21.897870218Z",
            "modified_time":  "2026-09-23T02:44:39Z",
            "sha256":  "dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / moudeva

Package

Name
moudeva
View open source insights on deps.dev
Purl
pkg:npm/moudeva

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "main.js",
            "sha256":  "ebf76ad4c5ec0d4526665a77a96bc4f5d90ee5af71d465ce038a7d67f27e4b57",
            "tlsh":  "6d93d65a6065113184336f759b376d16fb269127e041d358beac83c82fb1419ceb2fee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "moudeva-1.0.0.tgz",
            "hashes":  {
                "sha1":  "331b501ce7f20e32ba6b2a34fe8f4b52cb1f4059",
                "sha512_sri":  "sha512-uzTyDxZrmcnTwcsr+rO7a1tGLD55Ms1MpghTnDUWLF7YOKJdvC43Ffy6sFpUB+g2fK0v2EREWxqc/Qut/NYVCA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/moudeva/MAL-2026-16442.json"