MAL-2026-17775

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nitro-cjs-requirer/MAL-2026-17775.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17775
Published
2026-10-11T13:51:12Z
Modified
2026-10-11T14:30:08Z
Summary
Malicious code in nitro-cjs-requirer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b)

The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape — hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers — is a dependency-confusion or build-pipeline reconnaissance probe.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021409",
            "import_time": "2026-10-11T14:18:03.234826964Z",
            "modified_time": "2026-10-11T13:55:05Z",
            "sha256": "1cddd06b2ec2f8f432460f051b96f64db2fd2eb3a5cca5966ce9987d93b84052",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-021440",
            "import_time": "2026-10-11T14:18:06.186319166Z",
            "modified_time": "2026-10-11T14:00:00Z",
            "sha256": "b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-021406",
            "import_time": "2026-10-11T14:18:02.96104776Z",
            "modified_time": "2026-10-11T13:54:35Z",
            "sha256": "d3e330b9ba4b12d56187afb801280b4f629ecc2d8a6caa11ef8f19d39c5faff5",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-021405",
            "import_time": "2026-10-11T14:18:02.893388264Z",
            "modified_time": "2026-10-11T13:54:26Z",
            "sha256": "e1aaec8fedc0d25e84befb8dc069e8ec1869376b50c9500ee0194fead42426f5",
            "source": "amazon-inspector",
            "versions": [
                "2.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-021383",
            "import_time": "2026-10-11T14:18:01.136249744Z",
            "modified_time": "2026-10-11T13:51:12Z",
            "sha256": "f420c7a515f174ae453ff2bcfc84a554602d363bfd77aa4744f17deb6357ea11",
            "source": "amazon-inspector",
            "versions": [
                "99.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-021436",
            "import_time": "2026-10-11T14:18:05.791497694Z",
            "modified_time": "2026-10-11T13:59:21Z",
            "sha256": "abf51a98bdcb0068cdfe0026958859bc27434945ffc1db815bd44bded7dfe114",
            "source": "amazon-inspector",
            "versions": [
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / nitro-cjs-requirer

Package

Name
nitro-cjs-requirer
View open source insights on deps.dev
Purl
pkg:npm/nitro-cjs-requirer

Affected ranges

Affected versions

0.*
0.0.1
1.*
1.0.0
1.1.0
2.*
2.0.0
3.*
3.0.0
99.*
99.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "beacon.cjs",
            "sha256": "d3070b8fef42de65aef2a9ffe3b22d6c904520ded44be82ccd538fa7f507ec6c",
            "tlsh": "ac3161eba8e0a008aaa67098c54f0409b17bf0078501af50fd5c82919f6153c33fa8dc"
        },
        {
            "path": "index.js",
            "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity": [
        {
            "filename": "nitro-cjs-requirer-1.0.0.tgz",
            "hashes": {
                "sha1": "eeb3328db97869bb6fcab89219ad4904a0b9a856",
                "sha512_sri": "sha512-nsakMiZ8uWjjxWcvNwXJEnbBtxRE8im4IDYK4x2lzi2sDxsZMLn5DSk/ivAF0midPbj8XpR8YX+s6LcLZHNs2Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nitro-cjs-requirer/MAL-2026-17775.json"