{"id":"MAL-2026-14474","summary":"Malicious code in ecobee-api (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f)\nOn `npm install`, ecobee-api runs `node beacon.js` via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint http://169.58.96.170:9001/cb, passing the installer's hostname (os.hostname()) and the package name as query parameters. The package ships no functional library code — package.json declares an UNLICENSED 'Utility package' with a name resembling the Ecobee vendor, and the only substantive shipped file is the beacon. This is the shape of a dependency-confusion / typosquat recon beacon: it confirms install-time code execution on the victim host and identifies the host to the operator of 169.58.96.170 over plain HTTP.\n","modified":"2026-08-25T23:49:44.732419949Z","published":"2026-08-25T06:44:49Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018688","import_time":"2026-08-25T06:50:12.665874582Z","modified_time":"2026-08-25T06:44:49Z","sha256":"bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f","source":"amazon-inspector","versions":["0.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecobee-api/v/0.0.2"}],"affected":[{"package":{"name":"ecobee-api","ecosystem":"npm","purl":"pkg:npm/ecobee-api"},"versions":["0.0.2"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"c42cdebde43f0090d495ca54fb988ad0e55071b9529098a05347b0de515fa924","tlsh":"d7d023d651c4531854627111c57b0806e3d7d1122cd90e408c4042f25e7449629175f4","path":"beacon.js"},{"path":"package.json","sha256":"1775b8a74946a7193d8d1c7558981aab17b0e2745bb4e8512d54eac437ae34d8","tlsh":"9fd0a944ca101e6724c5aed30c24688aa1382c8b21087d082aa3004c038c3ba18fb238"}],"package_integrity":[{"filename":"ecobee-api-0.0.2.tgz","hashes":{"sha1":"75fb75375d7ee94fe1f655b1a7f0d83a57c9c3fb","sha512_sri":"sha512-8YZqKAoi+UrGHVN0sTN9VFcRP3EQohFxmY4rM7Muaqr/9l57VbhmaibI5QsMAdoWuum8igANEC5mNzO9h9LC6A=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ecobee-api/MAL-2026-14474.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}