MAL-2026-17774

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nitro-bundled-dep/MAL-2026-17774.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17774
Published
2026-10-11T13:50:38Z
Modified
2026-10-11T14:30:07Z
Summary
Malicious code in nitro-bundled-dep (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5)

nitro-bundled-dep@99.0.1 ships a stub main module (a Proxy that no-ops any property access) plus beacon.cjs, which runs both from the postinstall lifecycle hook (node beacon.cjs) and on top-level require() of index.js. The beacon reads os.hostname(), __dirname (install path), process.cwd(), and process.version and POSTs them over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not caller-configurable, is not associated with any published vendor, and has no relationship to the stated package purpose. The package name combined with version 99.0.1 and the inert stub body matches a dependency-confusion shape: an internal name resolved against the public registry at an implausibly high version pulls this beacon into the install, giving the operator of 185.158.107.175 confirmation of the host plus reconnaissance identifiers.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021380",
            "import_time": "2026-10-11T14:18:00.905141556Z",
            "modified_time": "2026-10-11T13:50:38Z",
            "sha256": "0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5",
            "source": "amazon-inspector",
            "versions": [
                "99.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-021400",
            "import_time": "2026-10-11T14:18:02.511535763Z",
            "modified_time": "2026-10-11T13:53:42Z",
            "sha256": "43f38c7ac6c0c53ea6787893d1a02c96e0a328e447c151104791f5b1ec4be0a3",
            "source": "amazon-inspector",
            "versions": [
                "2.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-021389",
            "import_time": "2026-10-11T14:18:01.639057095Z",
            "modified_time": "2026-10-11T13:52:07Z",
            "sha256": "7291ba5dfedba6c562a9cf2641f3ec3f489d8d05721836f4fb2a1674ef4e808a",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / nitro-bundled-dep

Package

Name
nitro-bundled-dep
View open source insights on deps.dev
Purl
pkg:npm/nitro-bundled-dep

Affected ranges

Affected versions

1.*
1.1.0
2.*
2.0.1
99.*
99.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "beacon.cjs",
            "sha256": "714abd13896833fdc6225b6cf615e48f4372fa51e5843cd3190a82b74ecfcce0",
            "tlsh": "9d3161eba8f1a0489aaa7098c54f0409b17bf0078401af50fd6c83919f6193c33fa8dc"
        },
        {
            "path": "index.js",
            "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity": [
        {
            "filename": "nitro-bundled-dep-99.0.1.tgz",
            "hashes": {
                "sha1": "b9251a9e983d4dbfc3b82d85a6745dc00cd4e98b",
                "sha512_sri": "sha512-/rMcdKmg0buD3+b8YiOufdpoPIR/8L2PD/+8/5v7dK7RSVn3yhHIBeuUtpue2uw12T/JsLQK+r6/wRkCV7tryA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nitro-bundled-dep/MAL-2026-17774.json"