{"id":"MAL-2026-17706","revision":"e719e1aee68c48b1b655e0f8316d6b5b","records":[{"revision":"e719e1aee68c48b1b655e0f8316d6b5b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17706","aliases":[],"title":"Malicious code in testrrrd (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (91a77cc9dbdff4799414082dc85fc6581b9f2d7297136dea8c50540f7d5244ad)\nOn `npm install`, package.json `scripts.postinstall` runs `node beacon.cjs`, which POSTs a JSON payload containing the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node version, and package identifier over plain HTTP to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The same beacon is re-triggered at import time: `index.js` (the declared `main`) calls `require('./beacon.cjs').fire()` and then exports a `Proxy` whose `get` trap returns a no-op for any member access, so consumers importing arbitrary names from the package continue past the callback. The dual trigger ensures the callback fires even when lifecycle scripts are suppressed (e.g. `npm install --ignore-scripts`), and the Proxy shim conceals that the package provides no legitimate functionality. The destination is a bare IPv4 address on a non-standard port unrelated to any declared publisher, and the transport is unencrypted.\n","state":0,"publishedAt":"2026-10-08T21:22:08+00:00","modifiedAt":"2026-10-08T21:45:54.2524885+00:00","affected":[{"ecosystem":"npm","name":"testrrrd","ranges":[],"versions":["1.0.0","0.0.1","3.0.0","99.0.1","2.0.1","1.1.0","2.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/testrrrd/v/1.0.0","https://www.npmjs.com/package/testrrrd/v/0.0.1","https://www.npmjs.com/package/testrrrd/v/3.0.0","https://www.npmjs.com/package/testrrrd/v/99.0.1","https://www.npmjs.com/package/testrrrd/v/2.0.1","https://www.npmjs.com/package/testrrrd/v/1.1.0","https://www.npmjs.com/package/testrrrd/v/2.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17706","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17706","identifiers":["MAL-2026-17706"]},"retained":false,"historicalAffected":[]}],"coverage":[]}