{"id":"MAL-2026-16442","summary":"Malicious code in moudeva (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a)\nThe package's main.js references child_process at multiple locations (lines 19, 883, 961) alongside HTTP POST calls (lines 365, 369) to a hardcoded endpoint https://ipc.shadxino.internal (referenced at lines 359 and 453). The.internal TLD is not a publicly registrable domain and is consistent with an attacker-controlled or otherwise non-legitimate destination that resolves only in a controlled network context. The co-location of a shell/process-execution primitive with an unconditional POST to a fixed non-standard host inside a single module matches the shape of installer-side command execution and data exfiltration.\n","modified":"2026-09-23T03:00:06.235320479Z","published":"2026-09-23T02:44:39Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-23T02:46:21.897870218Z","modified_time":"2026-09-23T02:44:39Z","sha256":"dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020343"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/moudeva/v/1.0.0"}],"affected":[{"package":{"name":"moudeva","ecosystem":"npm","purl":"pkg:npm/moudeva"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"ebf76ad4c5ec0d4526665a77a96bc4f5d90ee5af71d465ce038a7d67f27e4b57","tlsh":"6d93d65a6065113184336f759b376d16fb269127e041d358beac83c82fb1419ceb2fee","path":"main.js"}],"package_integrity":[{"filename":"moudeva-1.0.0.tgz","hashes":{"sha1":"331b501ce7f20e32ba6b2a34fe8f4b52cb1f4059","sha512_sri":"sha512-uzTyDxZrmcnTwcsr+rO7a1tGLD55Ms1MpghTnDUWLF7YOKJdvC43Ffy6sFpUB+g2fK0v2EREWxqc/Qut/NYVCA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/moudeva/MAL-2026-16442.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}