{"id":"MAL-2026-17774","summary":"Malicious code in nitro-bundled-dep (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5)\nnitro-bundled-dep@99.0.1 ships a stub main module (a Proxy that no-ops any property access) plus beacon.cjs, which runs both from the postinstall lifecycle hook (`node beacon.cjs`) and on top-level require() of index.js. The beacon reads os.hostname(), __dirname (install path), process.cwd(), and process.version and POSTs them over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not caller-configurable, is not associated with any published vendor, and has no relationship to the stated package purpose. The package name combined with version 99.0.1 and the inert stub body matches a dependency-confusion shape: an internal name resolved against the public registry at an implausibly high version pulls this beacon into the install, giving the operator of 185.158.107.175 confirmation of the host plus reconnaissance identifiers.\n","modified":"2026-10-11T14:30:07.619531821Z","published":"2026-10-11T13:50:38Z","database_specific":{"malicious-packages-origins":[{"versions":["99.0.1"],"id":"IN-MAL-2026-021380","import_time":"2026-10-11T14:18:00.905141556Z","modified_time":"2026-10-11T13:50:38Z","sha256":"0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["2.0.1"],"id":"IN-MAL-2026-021400","import_time":"2026-10-11T14:18:02.511535763Z","modified_time":"2026-10-11T13:53:42Z","sha256":"43f38c7ac6c0c53ea6787893d1a02c96e0a328e447c151104791f5b1ec4be0a3"},{"versions":["1.1.0"],"id":"IN-MAL-2026-021389","import_time":"2026-10-11T14:18:01.639057095Z","modified_time":"2026-10-11T13:52:07Z","sha256":"7291ba5dfedba6c562a9cf2641f3ec3f489d8d05721836f4fb2a1674ef4e808a","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/1.1.0"}],"affected":[{"package":{"name":"nitro-bundled-dep","ecosystem":"npm","purl":"pkg:npm/nitro-bundled-dep"},"versions":["99.0.1","2.0.1","1.1.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"714abd13896833fdc6225b6cf615e48f4372fa51e5843cd3190a82b74ecfcce0","tlsh":"9d3161eba8f1a0489aaa7098c54f0409b17bf0078401af50fd6c83919f6193c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-/rMcdKmg0buD3+b8YiOufdpoPIR/8L2PD/+8/5v7dK7RSVn3yhHIBeuUtpue2uw12T/JsLQK+r6/wRkCV7tryA==","sha1":"b9251a9e983d4dbfc3b82d85a6745dc00cd4e98b"},"filename":"nitro-bundled-dep-99.0.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nitro-bundled-dep/MAL-2026-17774.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}