Malicious code in peertube-plugin-poc-marker (npm)

The peertube-plugin-poc-marker package (version 1.0.0) includes code that runs system commands such as 'id', 'uname -a', 'hostname', 'date -u', and lists the PeerTube installation directory when its register() hook is invoked. The output is sent as JSON via a POST request to a hardcoded IP address (http://103.38.237.204:8444/poc) over plaintext HTTP. Additionally, the same data is stored in a plugin setting with 'private: false', making it accessible through the PeerTube public settings API. The destination is not configurable and unrelated to the plugin's stated functionality, indicating malicious intent to exfiltrate sensitive host information.

This malicious plugin can leak sensitive system information including user identity, kernel details, hostname, and installation paths to an external attacker-controlled server. The data exfiltration over plaintext HTTP exposes it to interception. The public exposure of this data via the PeerTube API increases the risk of unauthorized information disclosure. This compromises host privacy and could aid attackers in further targeting the affected system.

No official patch or remediation is documented for this malicious package. Users should immediately uninstall or avoid using peertube-plugin-poc-marker version 1.0.0. Review PeerTube plugin configurations and remove any instances of this plugin. Monitor for any unauthorized data exfiltration attempts. Since the plugin's behavior is malicious and unrelated to its declared purpose, it should be considered untrusted and blocked.