MAL-2026-14348

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/moidevy/MAL-2026-14348.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14348
Published
2026-08-21T04:19:16Z
Modified
2026-08-21T05:01:52.337578887Z
Summary
Malicious code in moidevy (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664)

main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal (referenced at lines 358 and 452, with POST calls at lines 364 and 368). The destination is not a documented public service and combined with childprocess usage in the same module matches the shape of an installer-side data exfiltration / remote-command channel. The .internal TLD is non-routable on the public internet, suggesting either a lure destination or infrastructure meant to be resolved via a custom resolver on compromised hosts.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018497",
            "sha256": "2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664",
            "modified_time": "2026-08-21T04:19:16Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-21T04:48:53.29122349Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / moidevy

Package

Name
moidevy
View open source insights on deps.dev
Purl
pkg:npm/moidevy

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "23b15a5a2d9fcea02a14d66e8c04f7d46cb38a04b3e6bfd55705f14ade8944b5",
            "path": "main.js",
            "tlsh": "0983d75a606511318433af758b3b6d16f726a523e0419354beacc3d82fb1419ceb2fee"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-pAOahL/0GoLW9XGvf/5vNKRSqNR036t39U6U6qsx2Bnx/EDZOLZ5QCanyJAPGjYLgoBshs6vaqXmAcs8xZfR2Q==",
                "sha1": "4d9c6f5184bd5291b22f4fa293afa55cb7f02b62"
            },
            "filename": "moidevy-1.0.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/moidevy/MAL-2026-14348.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]