{"id":"MAL-2026-17768","summary":"Malicious code in cloudflare_module (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242)\nPackage `cloudflare_module@99.0.1` is a dependency-confusion lure targeting the `cloudflare_*` namespace. `package.json` declares `scripts.postinstall: \"node beacon.cjs\"`, and `beacon.cjs` POSTs a JSON payload containing `os.hostname()`, the install path (`__dirname`), `process.cwd()`, and `process.version` to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plain HTTP. The package `main` (`index.js`) additionally calls `require('./beacon.cjs').fire()` at top level inside a try/catch, so the same host-identifier POST also fires whenever a downstream bundler or application `require()`s the package. The default export is a Proxy that returns a no-op for every property access, allowing bundlers that resolve an internal `cloudflare_module` name to complete the build cleanly so the beacon callback fires without producing errors. The package is published at version `99.0.1` with a generic \"Compatibility shim.\" description, consistent with version-bumping to beat an internal registry during resolution. The README self-labels the package as an \"authorized dependency-confusion test,\" but the beacon targets any machine that resolves the name — the installer never consents to the exfiltration — and the destination is an unattributed bare-IP collector, not infrastructure of the targeted namespace.\n","modified":"2026-10-11T17:30:47.987498910Z","published":"2026-10-11T13:51:50Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-11T14:18:03.313936647Z","modified_time":"2026-10-11T13:55:13Z","sha256":"0aeadec01dbc6c39254740f8f4557d53f8d7ab94136a4695525a70cd3f80d95d","source":"amazon-inspector","versions":["3.0.0"],"id":"IN-MAL-2026-021410"},{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-021387","import_time":"2026-10-11T14:18:01.469925982Z","modified_time":"2026-10-11T13:51:50Z","sha256":"14316e66f8d8eeb53b5fd4850537ac5398947feaf88f3837e39bfa587f60a0fb"},{"id":"IN-MAL-2026-021439","import_time":"2026-10-11T14:18:06.102897694Z","modified_time":"2026-10-11T13:59:51Z","sha256":"351579deaec7e5f856dfe103fbc8b7979b0f746e8e058bc3c1d35a00556bedf0","source":"amazon-inspector","versions":["1.0.0"]},{"source":"amazon-inspector","versions":["99.0.1"],"id":"IN-MAL-2026-021448","import_time":"2026-10-11T17:15:51.556858866Z","modified_time":"2026-10-11T16:53:13Z","sha256":"f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cloudflare_module/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cloudflare_module/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cloudflare_module/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cloudflare_module/v/99.0.1"}],"affected":[{"package":{"name":"cloudflare_module","ecosystem":"npm","purl":"pkg:npm/cloudflare_module"},"versions":["3.0.0","1.0.1","1.0.0","99.0.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"cloudflare_module-3.0.0.tgz","hashes":{"sha1":"11cb1eee1a57a04cd5f4c574706c16f470039730","sha512_sri":"sha512-+THmk0xaejcBalXPdQdXXIEXc4+a0hzFXshBDHPTkw72QTasmBzosaRPQEM9L4/cjIgyIwZcVjBFdOhEzEf0OQ=="}}],"evidence_files":[{"path":"beacon.cjs","sha256":"80779491720d41c53b5ed4cfbcbc70e9ebc144aaea61713d622eaa7a266c951b","tlsh":"813161eba8f0e048aaaa7098c54f0409b17af4078501af50f95d82915f6153c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cloudflare_module/MAL-2026-17768.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}