{"id":"MAL-2026-17774","revision":"3e98593b72434f27bc38227e099b9027","records":[{"revision":"3e98593b72434f27bc38227e099b9027","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17774","aliases":[],"title":"Malicious code in nitro-bundled-dep (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622)\nThe npm package nitro-bundled-dep@0.0.1 presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname, install path, current working directory, and Node version — to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The beacon in beacon.cjs is invoked from package.json's postinstall script, so it fires automatically on `npm install`, and is also invoked from index.js so it fires again whenever the module is required. The main module exports a Proxy that returns no-op functions for any property access, allowing a victim build that imports this name to continue without errors after the beacon has executed — the shape of a dependency-confusion / name-squat payload whose purpose is to confirm successful code execution inside a target build environment and report host identifiers to an attacker-controlled collector.\n","state":0,"publishedAt":"2026-10-11T13:50:38+00:00","modifiedAt":"2026-10-12T14:30:19.8342477+00:00","affected":[{"ecosystem":"npm","name":"nitro-bundled-dep","ranges":[],"versions":["99.0.1","2.0.1","1.1.0","0.0.1","1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/nitro-bundled-dep/v/99.0.1","https://www.npmjs.com/package/nitro-bundled-dep/v/2.0.1","https://www.npmjs.com/package/nitro-bundled-dep/v/1.1.0","https://www.npmjs.com/package/nitro-bundled-dep/v/0.0.1","https://www.npmjs.com/package/nitro-bundled-dep/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17774","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17774","identifiers":["MAL-2026-17774"]},"retained":false,"historicalAffected":[]}],"coverage":[]}