{"id":"MAL-2026-1809","revision":"b3b95dccdf4a434e88a32e1bfb082e00","records":[{"revision":"b3b95dccdf4a434e88a32e1bfb082e00","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-1809","aliases":[],"title":"Malicious code in ph-common (npm)","description":"ph-common is a dependency-confusion package: it is described as a \"Compatibility shim\", uses version numbers up to 99.0.1, and its README calls it an \"authorized dependency-confusion test\". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise979 published these 8 versions on 2026-10-05 between 02:09 and 02:16 UTC.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n","state":0,"publishedAt":"2026-03-18T13:03:27+00:00","modifiedAt":"2026-10-05T23:30:04.686943+00:00","affected":[{"ecosystem":"npm","name":"ph-common","ranges":[],"versions":["77.7.7","1.1.0","0.1.0","1.0.0","99.0.1","2.0.1","1.0.1","3.0.0","2.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/ph-common/v/1.1.0","https://www.npmjs.com/package/ph-common/v/0.1.0","https://www.npmjs.com/package/ph-common/v/1.0.0","https://www.npmjs.com/package/ph-common/v/99.0.1","https://www.npmjs.com/package/ph-common/v/2.0.1","https://www.npmjs.com/package/ph-common/v/1.0.1","https://www.npmjs.com/package/ph-common/v/3.0.0","https://www.npmjs.com/package/ph-common/v/2.0.0","https://www.npmjs.com/package/ph-common"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-1809","license":"OSV · upstream source license applies","key":"osv:MAL-2026-1809","identifiers":["MAL-2026-1809"]},"retained":false,"historicalAffected":[]}],"coverage":[]}