{"id":"MAL-2026-17641","revision":"d2f3eba3100c49ce82e89eb54fe1a578","records":[{"revision":"d2f3eba3100c49ce82e89eb54fe1a578","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17641","aliases":[],"title":"Malicious code in troubleshooting (npm)","description":"troubleshooting is a dependency-confusion package: it is described as a \"Compatibility shim\", uses version numbers up to 99.0.1, and its README calls it an \"authorized dependency-confusion test\". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 7 versions, and 6 versions of browser-metrics-plugin.contrib with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (28103a0b6203c0917551439eb348f6b197e382fad4e84d9bf2cbaadd48012ccb)\ntroubleshooting@2.0.1 is a stub package whose only functional behavior is a reconnaissance beacon. package.json declares `scripts.postinstall: node beacon.cjs`, which runs on `npm install`, and index.js runs the same beacon on `require('troubleshooting')` before exporting a Proxy whose properties all return no-ops so consuming bundlers do not crash. beacon.cjs collects the package name, `os.hostname()`, `__dirname` (install path), `process.cwd()`, and `process.version`, and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The README self-labels the package as an authorized dependency-confusion test, but the behavior is identical to a dependency-confusion exfiltration payload: any environment whose internal/private package name collides with `troubleshooting` on the public npm registry will have its build host, install path, working directory, and Node version reported to an outside party at a bare IP, providing actionable fingerprinting of internal build systems and CI runners.\n","state":0,"publishedAt":"2026-10-07T00:04:15+00:00","modifiedAt":"2026-10-08T04:00:05.4521285+00:00","affected":[{"ecosystem":"npm","name":"troubleshooting","ranges":[],"versions":["0.1.0","1.0.0","1.0.1","99.0.1","3.0.0","1.1.0","2.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/troubleshooting","https://www.npmjs.com/package/troubleshooting/v/1.0.1","https://www.npmjs.com/package/troubleshooting/v/3.0.0","https://www.npmjs.com/package/troubleshooting/v/2.0.1","https://www.npmjs.com/package/troubleshooting/v/1.1.0","https://www.npmjs.com/package/troubleshooting/v/0.1.0","https://www.npmjs.com/package/troubleshooting/v/1.0.0","https://www.npmjs.com/package/troubleshooting/v/99.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17641","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17641","identifiers":["MAL-2026-17641"]},"retained":false,"historicalAffected":[]}],"coverage":[]}