MAL-2026-6757

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vps-maintenance-paperclip-adapter/MAL-2026-6757.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6757
Published
2026-07-04T13:43:02Z
Modified
2026-07-04T14:46:38.050654780Z
Summary
Malicious code in vps-maintenance-paperclip-adapter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0de46c3e339f828f4c86612ee8bf74a29edc636511e2eaa765d8a75699849da3)

package.json declares a postinstall lifecycle script that runs an inline node -e payload opening a TCP socket to 185.112.147.174:7007 and piping it bidirectionally to a spawned /bin/sh process. On npm install, this immediately grants the operator of that hardcoded endpoint an interactive shell on the installer's host with the installing user's privileges, enabling arbitrary command execution, credential theft, and persistence. The package's stated 'VPS maintenance adapter' purpose does not require any outbound shell connection; the reverse-shell code path is unambiguous backdoor / install-time RCE.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.1.2"
            ],
            "sha256": "0de46c3e339f828f4c86612ee8bf74a29edc636511e2eaa765d8a75699849da3",
            "source": "amazon-inspector",
            "modified_time": "2026-07-04T13:43:02Z",
            "id": "IN-MAL-2026-007955",
            "import_time": "2026-07-04T14:34:32.046724145Z"
        }
    ]
}
References
Credits

Affected packages

npm / vps-maintenance-paperclip-adapter

Package

Name
vps-maintenance-paperclip-adapter
View open source insights on deps.dev
Purl
pkg:npm/vps-maintenance-paperclip-adapter

Affected ranges

Affected versions

0.*
0.1.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "vps-maintenance-paperclip-adapter-0.1.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-rJeZY0RmjzPFgRjID3xLVTCLLGuYkBQ/k1RB5n/Dy74U3NYRBm4ML3n1US6sWVB2wdIZILEE9LMuvRlmwMbvpg==",
                "sha1": "101e24fb569b4b70c9690b96b9831e675664d1d4"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "c2b1207a4b49b1d51e28e08452619755e63a1e9a8c1937233d9fdd976adde852",
            "path": "package.json",
            "tlsh": "3611ef35c9948f2321d840e42cb60617aaa504172255be1433ca216dc75e2db18ff39e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vps-maintenance-paperclip-adapter/MAL-2026-6757.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]