MAL-2026-16442

    Dashboard / Malicious Package / MAL-2026-16442

    MAL-2026-16442

    Published: 23 Sept 2026Last Modified: 23 Sept 2026

    Summary: Malicious code in moudeva (npm)

    Details: Source: amazon-inspector (dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a) The package's main.js references child_process at multiple locations (lines 19, 883, 961) alongside HTTP POST calls (lines 365, 369) to a hardcoded endpoint https://ipc.shadxino.internal (referenced at lines 359 and 453). The.internal TLD is not a publicly registrable domain and is consistent with an attacker-controlled or otherwise non-legitimate destination that resolves only in a controlled network context. The co-location of a shell/process-execution primitive with an unconditional POST to a fixed non-standard host inside a single module matches the shape of installer-side command execution and data exfiltration.

    References: https://www.npmjs.com/package/moudeva/v/1.0.0

    Affected packages

    Package

    Name: moudeva

    Purl: pkg:npm/moudeva

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0