moidevy @1.0.0
Vulnerability report · Last retrieved from osv.dev August 21, 2026 at 10:09 PM UTC
OSV ID
MAL-2026-14348
Ecosystem
npm
Summary
main.js imports child_process and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal (referenced at lines 358 and 452, with POST calls at lines 364 and 368). The destination is not a documented public service and combined with child_process usage in the same module matches the shape of an installer-side data exfiltration / remote-command channel. The .internal TLD is non-routable on the public internet, suggesting either a lure destination or infrastructure meant to be resolved via a custom resolver on compromised hosts.
Source: amazon-inspector (2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.