peertube-plugin-video-views-counter

{"modified":"2026-09-04T03:45:26Z","published":"2026-09-04T03:45:26Z","schema_version":"1.7.4","id":"MAL-2026-15902","summary":"Malicious code in peertube-plugin-video-views-counter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde)\nplugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'd, executing whenever PeerTube loads the plugin module. The same file registers a POST /cmd route on the plugin's HTTP router that passes a caller-supplied `cmd` field directly to child_process.exec with shell '/bin/bash' and returns stdout/stderr, with no authentication or allowlist. The reverse-shell code is labeled as a `background sync worker (keeps view history storage warm)` and its function is named `connect`, but performs no view-counting work. Together these give the remote host at 45.137.222.44 and any HTTP client able to reach the plugin router full interactive shell access on the PeerTube server.\n","affected":[{"package":{"ecosystem":"npm","name":"peertube-plugin-video-views-counter"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"plugin.js","sha256":"3c696654159d4dbe0d538f846ee6e7c8bb72ba4f150cff68e16eb49491181ca2","tlsh":"a241522b5ce4a11207b7f078a95f0806f927a103295f9aa9be5ec3104f4607c416ffe9"}],"package_integrity":[{"filename":"peertube-plugin-video-views-counter-1.0.2.tgz","hashes":{"sha1":"ebec3286d4ccf840f481929fc8124179e2901099","sha512_sri":"sha512-AjHK2J26WvyceRG3dDecF1fuGx6fkoNw12cEmRmj7UC3x9J6zVTN6xyaMpDLyF07g2y+kGP8oULFARV+ahzh0g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/peertube-plugin-video-views-counter/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019450","import_time":"2026-09-04T04:21:20.804009629Z","modified_time":"2026-09-04T03:45:26Z","sha256":"f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde","source":"amazon-inspector","versions":["1.0.2"]}]}}