Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

peertube-plugin-video-views-counternpm

Advisory published Updated

peertube-plugin-video-views-counter is a confirmed malicious npm package (MAL-2026-15902) that executes malicious code on install (malicious version 1.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in peertube-plugin-video-views-counter (npm)

MAL-2026-15902
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall peertube-plugin-video-views-counter

What this malware does

plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'd, executing whenever PeerTube loads the plugin module. The same file registers a POST /cmd route on the plugin's HTTP router that passes a caller-supplied cmd field directly to child_process.exec with shell '/bin/bash' and returns stdout/stderr, with no authentication or allowlist. The reverse-shell code is labeled as a background sync worker (keeps view history storage warm) and its function is named connect, but performs no view-counting work. Together these give the remote host at 45.137.222.44 and any HTTP client able to reach the plugin router full interactive shell access on the PeerTube server.

Malicious versions

1 flagged
1.0.2

Indicators of compromise (SHA-256)

f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde

Detection & response playbook

Malicious package

  1. Find it

    Search your lockfiles and build artifacts for peertube-plugin-video-views-counter (version 1.0.2).

  2. If you installed it — respond

    Remove peertube-plugin-video-views-counter from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

  3. Did it already run?

    If peertube-plugin-video-views-counter was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. peertube-plugin-video-views-counter on npm has been identified as a malicious package (version 1.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019450

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks peertube-plugin-video-views-counter-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
peertube-plugin-video-views-counter (npm) malicious package — MAL-2026-15902 | O3 Security