{"id":"MAL-2026-17775","summary":"Malicious code in nitro-cjs-requirer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b)\nThe package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape — hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers — is a dependency-confusion or build-pipeline reconnaissance probe.\n","modified":"2026-10-11T14:30:08.414391755Z","published":"2026-10-11T13:51:12Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-11T14:18:03.234826964Z","modified_time":"2026-10-11T13:55:05Z","sha256":"1cddd06b2ec2f8f432460f051b96f64db2fd2eb3a5cca5966ce9987d93b84052","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021409"},{"sha256":"b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b","source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-021440","import_time":"2026-10-11T14:18:06.186319166Z","modified_time":"2026-10-11T14:00:00Z"},{"id":"IN-MAL-2026-021406","import_time":"2026-10-11T14:18:02.96104776Z","modified_time":"2026-10-11T13:54:35Z","sha256":"d3e330b9ba4b12d56187afb801280b4f629ecc2d8a6caa11ef8f19d39c5faff5","source":"amazon-inspector","versions":["1.1.0"]},{"sha256":"e1aaec8fedc0d25e84befb8dc069e8ec1869376b50c9500ee0194fead42426f5","source":"amazon-inspector","versions":["2.0.0"],"id":"IN-MAL-2026-021405","import_time":"2026-10-11T14:18:02.893388264Z","modified_time":"2026-10-11T13:54:26Z"},{"source":"amazon-inspector","versions":["99.0.1"],"id":"IN-MAL-2026-021383","import_time":"2026-10-11T14:18:01.136249744Z","modified_time":"2026-10-11T13:51:12Z","sha256":"f420c7a515f174ae453ff2bcfc84a554602d363bfd77aa4744f17deb6357ea11"},{"import_time":"2026-10-11T14:18:05.791497694Z","modified_time":"2026-10-11T13:59:21Z","sha256":"abf51a98bdcb0068cdfe0026958859bc27434945ffc1db815bd44bded7dfe114","source":"amazon-inspector","versions":["3.0.0"],"id":"IN-MAL-2026-021436"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-cjs-requirer/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-cjs-requirer/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-cjs-requirer/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-cjs-requirer/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-cjs-requirer/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-cjs-requirer/v/3.0.0"}],"affected":[{"package":{"name":"nitro-cjs-requirer","ecosystem":"npm","purl":"pkg:npm/nitro-cjs-requirer"},"versions":["1.0.0","0.0.1","1.1.0","2.0.0","99.0.1","3.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"ac3161eba8e0a008aaa67098c54f0409b17bf0078501af50fd5c82919f6153c33fa8dc","path":"beacon.cjs","sha256":"d3070b8fef42de65aef2a9ffe3b22d6c904520ded44be82ccd538fa7f507ec6c"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-nsakMiZ8uWjjxWcvNwXJEnbBtxRE8im4IDYK4x2lzi2sDxsZMLn5DSk/ivAF0midPbj8XpR8YX+s6LcLZHNs2Q==","sha1":"eeb3328db97869bb6fcab89219ad4904a0b9a856"},"filename":"nitro-cjs-requirer-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nitro-cjs-requirer/MAL-2026-17775.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}