Warning: fake plugin indexes impersonating CommunityScripts ship reverse shells (linIp, Lincmd)

[digi-banana]

Two third-party plugin sources are circulating that mimic the CommunityScripts index layout (.../CommunityScripts/_site/index.yml) and ship reverse shells:

Source URL	Plugin	What it does
https://repo.alterkix.com/CommunityScripts/_site/index.yml	linIp — "Query ident.me to check my current IP (ensure VPN is working)"; its url: field claims S3L3CT3DLoves/stashPlugins	linIp.py opens a reverse shell to 217.160.25.65:13338 (socket → os.dup2 → pty.spawn("bash"))
https://mp.badkarma.ch/stash-plugins/_site/index.yml	Lincmd	Lincmd.py opens a reverse shell to 81.169.151.12:13338 (pty.spawn("sh")); mp.badkarma.ch itself resolves to that IP

How it was used: on an instance running with dangerous_allow_public_without_auth: true and no login configured, the two sources were added and the plugins installed and run remotely through the API. The shell was then used to steal data from the host and pivot further. Installing either plugin gives the operator a shell as the Stash process user, with whatever the container can reach (typically the whole media library and anything mounted into it).

If you have either source under Settings → Plugins → Available Plugins → sources:

1. Remove the source and delete the plugin folder (plugins/linIp, plugins/mp/Lincmd or similar).
2. Treat the host as compromised: look for unfamiliar processes spawned by stash, outbound connections to port 13338, and files such as an rclone binary in the config directory.
3. Turn off dangerous_allow_public_without_auth and set a username/password.

Suggestions for the project: a stronger warning when a plugin source is added from outside GitHub Pages, and a note in the docs that installing a plugin is equivalent to running arbitrary code on the host. Abuse reports have been sent to the hosting providers of both IPs.

Samples (plugin files and manifests) can be shared privately with maintainers on request.