MAL-2026-15902

    Dashboard / Malicious Package / MAL-2026-15902

    MAL-2026-15902

    Published: 4 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in peertube-plugin-video-views-counter (npm)

    Details: Source: amazon-inspector (f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde) plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'd, executing whenever PeerTube loads the plugin module. The same file registers a POST /cmd route on the plugin's HTTP router that passes a caller-supplied `cmd` field directly to child_process.exec with shell '/bin/bash' and returns stdout/stderr, with no authentication or allowlist. The reverse-shell code is labeled as a `background sync worker (keeps view history storage warm)` and its function is named `connect`, but performs no view-counting work. Together these give the remote host at 45.137.222.44 and any HTTP client able to reach the plugin router full interactive shell access on the PeerTube server.

    References: https://www.npmjs.com/package/peertube-plugin-video-views-counter/v/1.0.2

    Affected packages

    Package

    Name: peertube-plugin-video-views-counter

    Purl: pkg:npm/peertube-plugin-video-views-counter

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2