{"id":"MAL-2026-18276","revision":"c816cd0171f34da5a37d6d8c46f5a82e","records":[{"revision":"c816cd0171f34da5a37d6d8c46f5a82e","observedAt":"2026-10-25T16:17:16.268+00:00","statement":{"source":"osv","id":"MAL-2026-18276","aliases":[],"title":"Malicious code in @drone-js-ext/core (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43)\nThe package ships a `beacon.cjs` that collects host identifiers (hostname, install path, current working directory, Node version) and POSTs them in cleartext to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. This beacon is wired to run automatically in two places: `package.json` declares `scripts.postinstall = \"node beacon.cjs\"`, so it executes on `npm install`, and `index.js` also invokes the same `fire()` function at module load, so it executes again on `require()`. The remainder of the package is a no-op Proxy shim with no functional code matching the stated `Compatibility shim` description. The scope-and-version shape (`@drone-js-ext/core` at version 99.0.1 against a plausibly internal `@drone-js-ext/*` namespace) matches a dependency-confusion lure designed to be resolved in place of a private internal package. A README self-label of `dependency-confusion test` does not change the behavior: any installer that resolves this package has host-identifying data sent to a non-vendor, non-registry, bare-IP, plaintext-HTTP collector controlled by a third party.\n","state":0,"publishedAt":"2026-10-25T15:08:36+00:00","modifiedAt":"2026-10-25T15:30:05.5630459+00:00","affected":[{"ecosystem":"npm","name":"@drone-js-ext/core","ranges":[],"versions":["99.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@drone-js-ext/core/v/99.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18276","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18276","identifiers":["MAL-2026-18276"]},"retained":false,"historicalAffected":[]}],"coverage":[]}