{"id":"MAL-2026-17704","revision":"b039d782fa8141a3a33d9c394d85a48a","records":[{"revision":"b039d782fa8141a3a33d9c394d85a48a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17704","aliases":[],"title":"Malicious code in @wxwxtest/testrrrdd (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34)\nThe package ships a postinstall script (`scripts.postinstall` runs `node beacon.cjs`) and a top-level `require('./beacon.cjs').fire()` in `index.js` that POST installer host metadata — hostname, install path, cwd, Node version, and package name — to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The exfiltration fires automatically both on `npm install` and on any `require()` of the package. `index.js` otherwise exports a Proxy returning no-op functions for any property access, so the package has no legitimate functionality; its sole effect is the callback to the hardcoded endpoint. The destination is not associated with any publisher domain and is unrelated to the self-described 'compatibility shim' purpose. The shape (stub Proxy export + install/require-time beacon to a bare-IP collector) is a dependency-confusion / typosquat proof-of-installation beacon.\n","state":0,"publishedAt":"2026-10-08T21:21:17+00:00","modifiedAt":"2026-10-08T21:45:48.34213+00:00","affected":[{"ecosystem":"npm","name":"@wxwxtest/testrrrdd","ranges":[],"versions":["2.0.1","2.0.0","0.0.1","3.0.0","0.1.0","1.0.0","1.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.1","https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.0","https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.0.1","https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/3.0.0","https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.1.0","https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.0","https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17704","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17704","identifiers":["MAL-2026-17704"]},"retained":false,"historicalAffected":[]}],"coverage":[]}