registry  /  vps-new-manager  /  0.1.4

vps-new-manager@0.1.4

Paperclip external adapter that runs maintenance shell commands on the Paperclip host VPS (or another machine over SSH)

OSV Malicious Advisory

scanned 3h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-7014 confirms this npm version as malicious. The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent...

Advisory
MAL-2026-7014
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in vps-new-manager (npm)
Details
The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent. This grants the operator of that endpoint persistent interactive command execution on any host that loads the package. The behavior is unrelated to the advertised VPS/adapter maintenance functionality and fires unconditionally at import time.
Decision reason
OpenSSF Malicious Packages via OSV confirms vps-new-manager@0.1.4 as malicious (MAL-2026-7014): Malicious code in vps-new-manager (npm)

Source & flagged code

0 flagged
No flagged code excerpts are attached to this scan.

Findings

1 High
HighOsv Malicious Advisory