MAL-2026-7014
Malicious code in vps-new-manager (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7) The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent. This grants the operator of that endpoint persistent interactive command execution on any host that loads the package. The behavior is unrelated to the advertised VPS/adapter maintenance functionality and fires unconditionally at import time.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for vps-new-manager (npm). Pin to a known-safe version or switch to an alternative.