{"id":"MAL-2026-17879","summary":"Malicious code in @flexmr/ui (npm)","details":"`@flexmr/ui@99.99.99` runs `node beacon.js preinstall`, `node beacon.js install`, and `node beacon.js postinstall` during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to `177.7.60.239:48080` and encode the hostname in a DNS query under `oob.recon.dev`, probing whether a build resolves the package from the public npm registry; it was published on 2026-10-13.","modified":"2026-10-15T04:00:05.530368523Z","published":"2026-10-13T20:15:56Z","database_specific":{"iocs":{"urls":["http://177.7.60.239:48080"],"domains":["oob.recon.dev"],"files":[{"digests":{"sha256":"1f2f8a19a112cf6e024d832449377f596b5cbebb6fe548cfc2cc8f0cdab0e775"},"note":"preinstall script: node beacon.js preinstall; install script: node beacon.js install; postinstall script: node beacon.js postinstall","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"paths":["beacon.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"bdee8d65c1c5b40df70e851eda298aa0729f0a618e11d702a6e9a35285c4e2c3"},"note":"Executed by the preinstall, install and postinstall scripts of @flexmr/ui@99.99.99."}],"ips":["177.7.60.239"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@flexmr/ui"}],"affected":[{"package":{"name":"@flexmr/ui","ecosystem":"npm","purl":"pkg:npm/%40flexmr/ui"},"versions":["99.99.99"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@flexmr/ui/MAL-2026-17879.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}