MAL-2026-1809

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ph-common/MAL-2026-1809.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-1809

Published

2026-03-18T13:03:27Z

Modified

2026-10-05T23:30:04Z

Summary

Malicious code in ph-common (npm)

Details

ph-common is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise979 published these 8 versions on 2026-10-05 between 02:09 and 02:16 UTC.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)

The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (node beacon.cjs) and at import time via a top-level require('./beacon.cjs').fire() in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.

Database specific

{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                },
                "note":  "Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all 8 versions.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6a5f66dd89c04164b8e0f722af2ae135c1ffca82699096e35b2405dae32bc05e"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@0.1.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@0.1.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "b93e283e6b9f628345642ab6c4d1c461272184ab6b4e9778850ae80d30ef3e2a"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@1.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@1.0.1.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "943dfeba0f31d256c2d6bd4572ba0e70a0c7690e00ade2c9caf82918891cc2be"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@1.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@1.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "3db4a1c5bf1d3984463c2d3992081e42d181fc8ff250042402073d8df482a588"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@99.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@99.0.1.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "294e5ebaa5074ea63b094627ba52d89155015977d935db63c7ba74f53b068635"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@2.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@2.0.1.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "832986917d3304eff21125e453e973892ae2a98b72b05634c4b0bd3fd767672e"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@3.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@3.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "dbc09e0e15b86e74b28baf294dcef33773506d1ad04ea6841556a09ea1206482"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@2.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@2.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "387e2661119a6416fea3c84f9fc27cb31685a991e3ccbe9744f229e9fb229d04"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@1.1.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
                },
                "note":  "Executed by the postinstall script of ph-common@1.1.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "ips":  [
            "185.158.107.175"
        ],
        "urls":  [
            "http://185.158.107.175:8787/_ah/dc"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2026-01481",
            "import_time":  "2026-03-19T12:19:04.670517391Z",
            "modified_time":  "2026-03-18T13:03:27Z",
            "sha256":  "7babded8dfc238fb290582696a774cfd993a1e05077a8f8d717c602033cfd74e",
            "source":  "reversing-labs",
            "versions":  [
                "77.7.7"
            ]
        },
        {
            "import_time":  "2026-03-23T05:14:15.551325928Z",
            "modified_time":  "2026-03-23T05:11:41Z",
            "sha256":  "07a12a2296142889c91ff5760f4a0abc8866ea9a5e439847b8b5817565348b6e",
            "source":  "amazon-inspector",
            "versions":  [
                "77.7.7"
            ]
        },
        {
            "id":  "IN-MAL-2026-020982",
            "import_time":  "2026-10-05T03:57:36.449247157Z",
            "modified_time":  "2026-10-05T03:30:28Z",
            "sha256":  "3fc63c6b3f7884a467b0ac1e2ef73e7352eea07a9176c7904e4867cf00f109a0",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020989",
            "import_time":  "2026-10-05T03:57:37.037603644Z",
            "modified_time":  "2026-10-05T03:31:39Z",
            "sha256":  "500ba07f90fefe65b31bc11085a1e332f3fa76fbb6e468fae335d195e158b4af",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020984",
            "import_time":  "2026-10-05T03:57:36.6305859Z",
            "modified_time":  "2026-10-05T03:30:49Z",
            "sha256":  "96d5070e183f11c3850d1a87c10bc8b0d57aca3bb0731344a954fc211c3cb0a1",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020985",
            "import_time":  "2026-10-05T03:57:36.70455295Z",
            "modified_time":  "2026-10-05T03:31:01Z",
            "sha256":  "ccd64db80bd76a26cc4d34c24e3dcc3977570470ddd707cbd8e4716d212215da",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020980",
            "import_time":  "2026-10-05T03:57:36.277936001Z",
            "modified_time":  "2026-10-05T03:30:11Z",
            "sha256":  "dcc3f548923d3e691ce72ee5f05e21d1914b95b21f0d8fbe79fb39a1e63508ad",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020987",
            "import_time":  "2026-10-05T03:57:36.84551313Z",
            "modified_time":  "2026-10-05T03:31:20Z",
            "sha256":  "dd0f82dbeac7915ba439ea273f5662da59458c61de3e2729fd8fccbde94799c9",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020981",
            "import_time":  "2026-10-05T03:57:36.363004781Z",
            "modified_time":  "2026-10-05T03:30:21Z",
            "sha256":  "e91af37ddf73f0ab03685d169764db14d995358fc3de58392d4e6f880589844a",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020983",
            "import_time":  "2026-10-05T03:57:36.511438179Z",
            "modified_time":  "2026-10-05T03:30:40Z",
            "sha256":  "f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
  - inspector-research@amazon.com
- InvisiRisk, Inc. - FINDER
- - https://www.invisirisk.com
  - mailto:research@invisirisk.com
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / ph-common

Package

Name: ph-common; View open source insights on deps.dev
Purl: pkg:npm/ph-common

Affected ranges

Affected versions

0.*

0.1.0

1.*

1.0.0

1.0.1

1.1.0

2.*

2.0.0

2.0.1

3.*

3.0.0

77.*

77.7.7

99.*

99.0.1

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c",
            "tlsh":  "2f314feba8e1a048aaaa7498c54f1409b27af4079501ab50f95c92959f6193c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ph-common-1.1.0.tgz",
            "hashes":  {
                "sha1":  "3b29232f4cf830444c731280a88545fcb3904597",
                "sha512_sri":  "sha512-qXYW44dtByDSdH1p1nsWUqFC0MkC6Q/f3ybsViWox6dLaWuN81ZGg30M1iME5OLUS935kNT2pRPzrF24qf8LFg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ph-common/MAL-2026-1809.json"