MAL-2026-14348

    Dashboard / Malicious Package / MAL-2026-14348

    MAL-2026-14348

    Published: 21 Aug 2026Last Modified: 21 Aug 2026

    Summary: Malicious code in moidevy (npm)

    Details: Source: amazon-inspector (2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664) main.js imports child_process and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal (referenced at lines 358 and 452, with POST calls at lines 364 and 368). The destination is not a documented public service and combined with child_process usage in the same module matches the shape of an installer-side data exfiltration / remote-command channel. The `.internal` TLD is non-routable on the public internet, suggesting either a lure destination or infrastructure meant to be resolved via a custom resolver on compromised hosts.

    References: https://www.npmjs.com/package/moidevy/v/1.0.0

    Affected packages

    Package

    Name: moidevy

    Purl: pkg:npm/moidevy

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14348 | CVE-DB