moudeva

GHSA-8c6q-78vh-4fwp

Malicious code in moudeva (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a)
The package's main.js references child_process at multiple locations (lines 19, 883, 961) alongside HTTP POST calls (lines 365, 369) to a hardcoded endpoint https://ipc.shadxino.internal (referenced at lines 359 and 453). The.internal TLD is not a publicly registrable domain and is consistent with an attacker-controlled or otherwise non-legitimate destination that resolves only in a controlled network context. The co-location of a shell/process-execution primitive with an unconditional POST to a fixed non-standard host inside a single module matches the shape of installer-side command execution and data exfiltration.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/moudeva/MAL-2026-16442.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/moudeva/MAL-2026-16442.json
- https://www.npmjs.com/package/moudeva/v/1.0.0
- https://github.com/advisories/GHSA-8c6q-78vh-4fwp

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.