@baipiaojuntuan/reverseproxy-fm@1.0.9
Malicious code in @baipiaojuntuan/reverseproxy-fm (npm)
Analysis
The package's bin entry (index.js) schedules a shell command 2 seconds after the server starts. The command is obfuscated as ~98 fragmented shell variables that are concatenated and evaluated, and it implements a download-and-execute dropper: it detects the host package manager (apk/apt/yum), installs curl or wget if missing, then fetches hxxps://gbjs[.]serv00[.]net/sh/pm2nodeservice[.]sh and pipes it to bash (with a wget -qO- fallback). The package also exposes the user's entire home directory as an authenticated web file browser with browse/download/upload/delete capabilities via the /fm route.
- analyzed by
- Leitwacht
- first seen
- Sep 4, 2026, 05:18 PM
- analyzed
- Sep 4, 2026, 05:23 PM
Related advisories
- hydration-cls-ui@1.0.0
- hydration-ui-dim@1.0.0
- hydration-dim-kit@1.0.0
- @oss-core-eng/data-formatter@1.0.1
- kit-vim-map@1.0.0
- kit-map-streak@1.0.0
- streak-kit-map@1.0.0
- streak-map-cache@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.