MAL-2026-15817

    Dashboard / Malicious Package / MAL-2026-15817

    MAL-2026-15817

    Published: 2 Sept 2026Last Modified: 2 Sept 2026

    Summary: Malicious code in peertube-plugin-poc-marker (npm)

    Details: Source: amazon-inspector (ff307f6227ac4a9217a899b419a6931ddfe0376cb0cc6ba3570c0f589247241c) index.js runs `id; uname -a; hostname; date -u; ls -d /var/www/peertube` via execSync when PeerTube invokes the plugin's register() hook, then POSTs the combined stdout as JSON to the hardcoded bare-IP collector http://103.38.237.204:8444/poc over plaintext HTTP. The same reconnaissance output is also written into a `poc_proof` plugin setting registered with `private: false`, providing a second read-back channel via the PeerTube public settings API. The destination host is not configurable, is unrelated to the plugin's declared PeerTube purpose, and captures the host's user, kernel, hostname, and PeerTube install path from the server on which the plugin is loaded.

    References: https://www.npmjs.com/package/peertube-plugin-poc-marker/v/1.0.0

    Affected packages

    Package

    Name: peertube-plugin-poc-marker

    Purl: pkg:npm/peertube-plugin-poc-marker

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0