MAL-2026-14348
Malicious code in moidevy (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664) main.js imports child_process and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal (referenced at lines 358 and 452, with POST calls at lines 364 and 368). The destination is not a documented public service and combined with child_process usage in the same module matches the shape of an installer-side data exfiltration / remote-command channel. The `.internal` TLD is non-routable on the public internet, suggesting either a lure destination or infrastructure meant to be resolved via a custom resolver on compromised hosts.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for moidevy (npm). Pin to a known-safe version or switch to an alternative.