Malicious code in peertube-plugin-video-views-counter (npm)

The plugin.js file in peertube-plugin-video-views-counter version 1.0.2 includes a top-level Immediately Invoked Function Expression (IIFE) that spawns a detached bash reverse shell connecting to 45.137.222.44:4444 whenever the plugin module loads. Additionally, it registers an unauthenticated POST /cmd HTTP route that executes arbitrary shell commands supplied in the 'cmd' field via child_process.exec with /bin/bash, returning the command output. These combined behaviors grant any remote client with HTTP access to the plugin router full shell access on the server, representing a severe backdoor and remote code execution threat.

Remote attackers can gain full interactive shell access on the PeerTube server by exploiting the reverse shell and the unauthenticated command execution endpoint. This compromises the confidentiality, integrity, and availability of the affected system and potentially the broader network environment.

No official patch or remediation is currently documented. Users should immediately remove or disable the peertube-plugin-video-views-counter version 1.0.2 plugin to prevent exploitation. Monitor for any unauthorized access and consider restoring affected systems from known good backups. Check vendor advisories or trusted sources for updates or patches before re-enabling the plugin.