MAL-2026-15902

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde) plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'd, executing whenever PeerTube loads the plugin module. The same file registers a POST /cmd route on the plugin's HTTP router that passes a caller-supplied `cmd` field directly to child_process.exec with shell '/bin/bash' and returns stdout/stderr, with no authentication or allowlist. The reverse-shell code is labeled as a `background sync worker (keeps view history storage warm)` and its function is named `connect`, but performs no view-counting work. Together these give the remote host at 45.137.222.44 and any HTTP client able to reach the plugin router full interactive shell access on the PeerTube server.