{"id":"MAL-2026-17767","summary":"Malicious code in another-very-long-name (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf)\nanother-very-long-name@1.0.1 ships a beacon.cjs that is invoked both from the declared postinstall lifecycle script and from the module's require()-time entry (index.js). On execution it collects host identifiers — hostname, install path, process.cwd(), process.version, OS metadata, and the package name — and POSTs them as JSON to the hardcoded cleartext endpoint http://185.158.107.175:8787/_ah/dc. The package exposes no genuine functionality: index.js returns a Proxy whose get handler returns a no-op for every property so that bundlers consuming the package do not fail, and an author comment states that a build that completes and calls back is cleaner evidence. The destination is a bare-IP HTTP endpoint with no first-party relationship to any declared publisher, and the stub-plus-beacon shape is consistent with a dependency-confusion reconnaissance probe rather than a compatibility shim.\n","modified":"2026-10-11T14:30:07.619716672Z","published":"2026-10-11T13:54:57Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["2.0.0"],"id":"IN-MAL-2026-021408","import_time":"2026-10-11T14:18:03.165996858Z","modified_time":"2026-10-11T13:54:57Z","sha256":"6988ed51b76af3ebc9669995197300dc5fc6033d22ddae47452d29eb1805d8b8"},{"modified_time":"2026-10-11T13:55:51Z","sha256":"eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-021414","import_time":"2026-10-11T14:18:03.613823077Z"},{"import_time":"2026-10-11T14:18:03.683945708Z","modified_time":"2026-10-11T13:55:58Z","sha256":"6aca6f0008885dfc94cb075eafd3046583b8145832841e9b6bdcdcd7d3f6b677","source":"amazon-inspector","versions":["2.0.1"],"id":"IN-MAL-2026-021415"},{"versions":["1.1.0"],"id":"IN-MAL-2026-021411","import_time":"2026-10-11T14:18:03.394239261Z","modified_time":"2026-10-11T13:55:22Z","sha256":"91f6c27f7806ad8e28214d0f55858f9cc7255639414dc1425ff5301919df5aff","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/another-very-long-name/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/another-very-long-name/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/another-very-long-name/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/another-very-long-name/v/1.1.0"}],"affected":[{"package":{"name":"another-very-long-name","ecosystem":"npm","purl":"pkg:npm/another-very-long-name"},"versions":["2.0.0","1.0.1","2.0.1","1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"another-very-long-name-2.0.0.tgz","hashes":{"sha1":"d96abbde2d1ffa3dad3722507d52ffda50b963cf","sha512_sri":"sha512-9b5+L5ky33lmpyR+U3qwVT4eyQITC183BBzmNL0PKJctiOunrDCcSWSjT0NT0C9834M+Qk44xEraliNUw5/3kQ=="}}],"evidence_files":[{"path":"beacon.cjs","sha256":"9c3e88c3e9ee9bb8c9e808cee834304e84bb1b90f2c936d82a33898146c2cdeb","tlsh":"4c3161eba8e1e0489aaa7098c54f1409b27af0068401af50fd5c82959f6293c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/another-very-long-name/MAL-2026-17767.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}