OSV Malicious Advisory
scanned 3h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-7014 confirms this npm version as malicious. The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent...
Advisory
MAL-2026-7014
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in vps-new-manager (npm)
Details
The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent. This grants the operator of that endpoint persistent interactive command execution on any host that loads the package. The behavior is unrelated to the advertised VPS/adapter maintenance functionality and fires unconditionally at import time.
Decision reason
OpenSSF Malicious Packages via OSV confirms vps-new-manager@0.1.4 as malicious (MAL-2026-7014): Malicious code in vps-new-manager (npm)
References
Source & flagged code
0 flaggedNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory