{"id":"MAL-2026-17773","summary":"Malicious code in nested-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928)\nThe package declares `scripts.postinstall = \"node beacon.cjs\"` and `index.js` also invokes `require('./beacon.cjs').fire()` at module load. `beacon.cjs` POSTs a JSON payload containing `os.hostname()`, `__dirname`, `process.cwd()`, and `process.version` over plain HTTP to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The destination is not a documented first-party service and the host identifiers are sent without any opt-in. `index.js` otherwise exports a Proxy that returns no-op functions for every property access, so the package provides no real functionality — its sole on-install and on-require effect is the beacon. The combination of a hollow Proxy shim, a bare-IP plain-HTTP destination, and automatic firing from both the npm lifecycle hook and the main module is consistent with a reconnaissance/confirmation beacon used to validate successful installation into target environments, typically preceding a second-stage payload.\n","modified":"2026-10-11T14:30:06.704529911Z","published":"2026-10-11T13:53:33Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021399","import_time":"2026-10-11T14:18:02.421043506Z","modified_time":"2026-10-11T13:53:33Z","sha256":"0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928"},{"sha256":"ab87d579d75ebc0c4d4bbeeb2d27aedbe7350e0522cd34b00947f7d802d9148f","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-021402","import_time":"2026-10-11T14:18:02.670836204Z","modified_time":"2026-10-11T13:53:58Z"},{"import_time":"2026-10-11T14:18:02.794246981Z","modified_time":"2026-10-11T13:54:17Z","sha256":"b5cf1b7875d61d769d7b3d89e1695a3bd8425947919ef47cae55579700507ab9","source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-021404"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nested-lib/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nested-lib/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nested-lib/v/1.1.0"}],"affected":[{"package":{"name":"nested-lib","ecosystem":"npm","purl":"pkg:npm/nested-lib"},"versions":["1.0.0","1.0.1","1.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nested-lib/MAL-2026-17773.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"4a042363b02ff38857adcf2e16a138e65d57fce4","sha512_sri":"sha512-JMIYKfglrdDxK9Mwd/AJ3inVI4QkwkM1GwchfVgPMo1mjlN2Xxcx8anEw+RKXrBB5lMFskEBk+T1i5mM/hWcfw=="},"filename":"nested-lib-1.0.0.tgz"}],"evidence_files":[{"tlsh":"4f3141eba8e1a048aaa67498c54f1409f17af4069501ab54f95c82955f6193c33fa8dc","path":"beacon.cjs","sha256":"f3f0a7ededa67ce0264ed76a0ca75689b8f775a28325bffcf6f23edc770b9986"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}