peertube-plugin-video-views-counter@1.0.2

Summary

plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'd, executing whenever PeerTube loads the plugin module. The same file registers a POST /cmd route on the plugin's HTTP router that passes a caller-supplied cmd field directly to child_process.exec with shell '/bin/bash' and returns stdout/stderr, with no authentication or allowlist. The reverse-shell code is labeled as a background sync worker (keeps view history storage warm) and its function is named connect, but performs no view-counting work. Together these give the remote host at 45.137.222.44 and any HTTP client able to reach the plugin router full interactive shell access on the PeerTube server.

Source: amazon-inspector (f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde)