MAL-2026-17640

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/browser-metrics-plugin.contrib/MAL-2026-17640.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-17640

Published

2026-10-07T00:01:40Z

Modified

2026-10-08T04:00:04Z

Summary

Malicious code in browser-metrics-plugin.contrib (npm)

Details

browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 6 versions, and 7 versions of troubleshooting with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded)

browser-metrics-plugin.contrib@1.0.1 ships beacon.cjs which POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and Node version to the hardcoded cleartext bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires twice: once from a postinstall lifecycle hook on npm install, and again at require time from index.js (the declared main), which calls require('./beacon.cjs').fire() at top level inside a try/catch. The module exports a Proxy of no-ops so that load failures do not break the surrounding build, concealing the beacon's presence. The second trigger ensures the callback fires even when scripts are disabled via --ignore-scripts. The combination of hardcoded bare-IP destination (no TLS, no domain), host identifier collection at install and import time, dual-trigger design, and silencing wrapper is the canonical dependency-confusion exfiltration shape. A README self-label as a 'research' or 'dependency-confusion test' package is author-controlled and does not constitute installer consent; the hostname and install path disclose internal corporate build infrastructure to a third party.

Database specific

{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                },
                "note":  "Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "88be31855364b43e29af8f413bf77718668e433e9b99ecff86af611f691efbba"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@0.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
                },
                "note":  "Executed by the postinstall script of browser-metrics-plugin.contrib@0.0.1.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "f685ef1fd4bf7e6c89a1d30f9a95fb2565bf43aef8926c47831ea406ce6ec68f"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
                },
                "note":  "Executed by the postinstall script of browser-metrics-plugin.contrib@1.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "91930c57df71a1daf5175de4fc1321cd2141a74d5e65ba65bb27f29d3fda5d4c"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.1.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
                },
                "note":  "Executed by the postinstall script of browser-metrics-plugin.contrib@1.1.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ee6d3b15a0f508112999466fd4eb170cb891850297f3bed92d3d657937886d4f"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@99.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
                },
                "note":  "Executed by the postinstall script of browser-metrics-plugin.contrib@99.0.1.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "24fddf171255e79f57cafdc4f3f98f3b4beb61fd5f655c2dd2ac7ba2a657a678"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
                },
                "note":  "Executed by the postinstall script of browser-metrics-plugin.contrib@1.0.1.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "fd6ab85e9991034a33de280acf3acba5c15ea35210227017a764df9c420ff1e8"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@2.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
                },
                "note":  "Executed by the postinstall script of browser-metrics-plugin.contrib@2.0.1.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "ips":  [
            "185.158.107.175"
        ],
        "urls":  [
            "http://185.158.107.175:8787/_ah/dc"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021130",
            "import_time":  "2026-10-08T03:50:29.902936689Z",
            "modified_time":  "2026-10-08T03:40:25Z",
            "sha256":  "5c14ea3f89a327e671b6bb6bfd27cb0db7fbc92f0777b89710442b792740d073",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021114",
            "import_time":  "2026-10-08T03:50:28.789336342Z",
            "modified_time":  "2026-10-08T03:38:02Z",
            "sha256":  "8123f97c3618eb20a66da2dfb8a45256e76fb1c84c4a17ce844dac7a2389bfe6",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021107",
            "import_time":  "2026-10-08T03:50:28.33757488Z",
            "modified_time":  "2026-10-08T03:36:55Z",
            "sha256":  "add156e4ab0c336588911b9741dc7b10a5b1471d4b094e2410c5325ceecb3401",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021108",
            "import_time":  "2026-10-08T03:50:28.395578472Z",
            "modified_time":  "2026-10-08T03:37:06Z",
            "sha256":  "b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021110",
            "import_time":  "2026-10-08T03:50:28.532299242Z",
            "modified_time":  "2026-10-08T03:37:22Z",
            "sha256":  "ba360d12dd9384c50c52bb7367dcee82bc20aa303178b4782e9f2fb8b823f5c6",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021109",
            "import_time":  "2026-10-08T03:50:28.455278516Z",
            "modified_time":  "2026-10-08T03:37:14Z",
            "sha256":  "d92366e7357cc9d42be3e33965b1c6bac85403f0b3f1fc079e33e81b81b61827",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- InvisiRisk, Inc. - FINDER
- - https://www.invisirisk.com
  - mailto:research@invisirisk.com

Affected packages

npm / browser-metrics-plugin.contrib

Package

Name: browser-metrics-plugin.contrib; View open source insights on deps.dev
Purl: pkg:npm/browser-metrics-plugin.contrib

Affected ranges

Affected versions

0.*

0.0.1

1.*

1.0.0

1.0.1

1.1.0

2.*

2.0.1

99.*

99.0.1

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778",
            "tlsh":  "883161eba8e4a0489eaa7098c54f0409b17bf4069401ab50fd5c82915f6197c33fa8dc"
        },
        {
            "path":  "README.md",
            "sha256":  "b4f5478f42b53a0b482c1cd846ed7ec27ae2cf57a6e738b415905c37ccbaae0e",
            "tlsh":  "8bd02b347424653054284bf648a1b06957fcd2bcc42645b9585e5e0c544a768532777a"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "browser-metrics-plugin.contrib-99.0.1.tgz",
            "hashes":  {
                "sha1":  "6d8ca12624667ec5718440c6e8b1f97b7f98abdc",
                "sha512_sri":  "sha512-Rr9PzrM5ZkjOYl5enckeUJ5T3Vtm1R40kTTuhcVpYpMWejgCj3P3WGmDpxHEQvUE5//grsZc29A67BLdPVDL0g=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/browser-metrics-plugin.contrib/MAL-2026-17640.json"