{"id":"MAL-2026-1809","summary":"Malicious code in ph-common (npm)","details":"ph-common is a dependency-confusion package: it is described as a \"Compatibility shim\", uses version numbers up to 99.0.1, and its README calls it an \"authorized dependency-confusion test\". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise979 published these 8 versions on 2026-10-05 between 02:09 and 02:16 UTC.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n","modified":"2026-10-05T23:30:04.686942984Z","published":"2026-03-18T13:03:27Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-03-18T13:03:27Z","sha256":"7babded8dfc238fb290582696a774cfd993a1e05077a8f8d717c602033cfd74e","source":"reversing-labs","versions":["77.7.7"],"id":"RLMA-2026-01481","import_time":"2026-03-19T12:19:04.670517391Z"},{"import_time":"2026-03-23T05:14:15.551325928Z","modified_time":"2026-03-23T05:11:41Z","sha256":"07a12a2296142889c91ff5760f4a0abc8866ea9a5e439847b8b5817565348b6e","source":"amazon-inspector","versions":["77.7.7"]},{"id":"IN-MAL-2026-020982","import_time":"2026-10-05T03:57:36.449247157Z","modified_time":"2026-10-05T03:30:28Z","sha256":"3fc63c6b3f7884a467b0ac1e2ef73e7352eea07a9176c7904e4867cf00f109a0","source":"amazon-inspector","versions":["1.1.0"]},{"source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-020989","import_time":"2026-10-05T03:57:37.037603644Z","modified_time":"2026-10-05T03:31:39Z","sha256":"500ba07f90fefe65b31bc11085a1e332f3fa76fbb6e468fae335d195e158b4af"},{"import_time":"2026-10-05T03:57:36.6305859Z","modified_time":"2026-10-05T03:30:49Z","sha256":"96d5070e183f11c3850d1a87c10bc8b0d57aca3bb0731344a954fc211c3cb0a1","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020984"},{"import_time":"2026-10-05T03:57:36.70455295Z","modified_time":"2026-10-05T03:31:01Z","sha256":"ccd64db80bd76a26cc4d34c24e3dcc3977570470ddd707cbd8e4716d212215da","source":"amazon-inspector","versions":["99.0.1"],"id":"IN-MAL-2026-020985"},{"import_time":"2026-10-05T03:57:36.277936001Z","modified_time":"2026-10-05T03:30:11Z","sha256":"dcc3f548923d3e691ce72ee5f05e21d1914b95b21f0d8fbe79fb39a1e63508ad","source":"amazon-inspector","versions":["2.0.1"],"id":"IN-MAL-2026-020980"},{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-020987","import_time":"2026-10-05T03:57:36.84551313Z","modified_time":"2026-10-05T03:31:20Z","sha256":"dd0f82dbeac7915ba439ea273f5662da59458c61de3e2729fd8fccbde94799c9"},{"sha256":"e91af37ddf73f0ab03685d169764db14d995358fc3de58392d4e6f880589844a","source":"amazon-inspector","versions":["3.0.0"],"id":"IN-MAL-2026-020981","import_time":"2026-10-05T03:57:36.363004781Z","modified_time":"2026-10-05T03:30:21Z"},{"import_time":"2026-10-05T03:57:36.511438179Z","modified_time":"2026-10-05T03:30:40Z","sha256":"f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2","source":"amazon-inspector","versions":["2.0.0"],"id":"IN-MAL-2026-020983"}],"iocs":{"urls":["http://185.158.107.175:8787/_ah/dc"],"files":[{"paths":["index.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"},"note":"Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all 8 versions."},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6a5f66dd89c04164b8e0f722af2ae135c1ffca82699096e35b2405dae32bc05e"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@0.1.0).","paths":["package.json"]},{"note":"Executed by the postinstall script of ph-common@0.1.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"}},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"b93e283e6b9f628345642ab6c4d1c461272184ab6b4e9778850ae80d30ef3e2a"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@1.0.1)."},{"paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"},"note":"Executed by the postinstall script of ph-common@1.0.1."},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"943dfeba0f31d256c2d6bd4572ba0e70a0c7690e00ade2c9caf82918891cc2be"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@1.0.0).","paths":["package.json"]},{"note":"Executed by the postinstall script of ph-common@1.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"}},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"3db4a1c5bf1d3984463c2d3992081e42d181fc8ff250042402073d8df482a588"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@99.0.1)."},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"},"note":"Executed by the postinstall script of ph-common@99.0.1.","paths":["beacon.cjs"]},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"294e5ebaa5074ea63b094627ba52d89155015977d935db63c7ba74f53b068635"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@2.0.1).","paths":["package.json"]},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"},"note":"Executed by the postinstall script of ph-common@2.0.1.","paths":["beacon.cjs"]},{"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@3.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"832986917d3304eff21125e453e973892ae2a98b72b05634c4b0bd3fd767672e"}},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"},"note":"Executed by the postinstall script of ph-common@3.0.0.","paths":["beacon.cjs"]},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"dbc09e0e15b86e74b28baf294dcef33773506d1ad04ea6841556a09ea1206482"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@2.0.0).","paths":["package.json"]},{"paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"},"note":"Executed by the postinstall script of ph-common@2.0.0."},{"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (ph-common@1.1.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"387e2661119a6416fea3c84f9fc27cb31685a991e3ccbe9744f229e9fb229d04"}},{"note":"Executed by the postinstall script of ph-common@1.1.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"}}],"ips":["185.158.107.175"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ph-common"}],"affected":[{"package":{"name":"ph-common","ecosystem":"npm","purl":"pkg:npm/ph-common"},"versions":["77.7.7","1.1.0","0.1.0","1.0.0","99.0.1","2.0.1","1.0.1","3.0.0","2.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c","tlsh":"2f314feba8e1a048aaaa7498c54f1409b27af4079501ab50f95c92959f6193c33fa8dc"},{"sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee","path":"index.js"}],"package_integrity":[{"hashes":{"sha1":"3b29232f4cf830444c731280a88545fcb3904597","sha512_sri":"sha512-qXYW44dtByDSdH1p1nsWUqFC0MkC6Q/f3ybsViWox6dLaWuN81ZGg30M1iME5OLUS935kNT2pRPzrF24qf8LFg=="},"filename":"ph-common-1.1.0.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ph-common/MAL-2026-1809.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}