{"id":"MAL-2026-18277","revision":"fb92aceb9d244f5389e9d64abe66eecc","records":[{"revision":"fb92aceb9d244f5389e9d64abe66eecc","observedAt":"2026-10-26T07:21:08.838+00:00","statement":{"source":"osv","id":"MAL-2026-18277","aliases":[],"title":"Malicious code in @drone-js-ext/vip-badge (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (914f57c3481f23f4682ff7bdd7b9849865531023c6d547ed76d42e9da6bbd8dc)\n@drone-js-ext/vip-badge is a functionless stub whose only behavior is a phone-home beacon. The package.json postinstall script runs `node beacon.cjs`, and `index.js` fires the same beacon on `require()` while exporting a Proxy that returns no-ops for every property access. beacon.cjs collects the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node.js version, and package coordinate, then POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The destination is not the npm registry, not a publisher-owned domain, and is reached automatically at install time and on module load without any caller invocation. The scope name mimics a plausible internal/vendor namespace, and the shipped contents match the dependency-confusion beacon pattern — a stub published to prove install on target networks and disclose host identity to an uncontrolled third party.\n","state":0,"publishedAt":"2026-10-25T04:50:18+00:00","modifiedAt":"2026-10-26T06:45:16.0437638+00:00","affected":[{"ecosystem":"npm","name":"@drone-js-ext/vip-badge","ranges":[],"versions":["99.0.1","0.0.1","2.0.0","1.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@drone-js-ext/vip-badge/v/99.0.1","https://www.npmjs.com/package/@drone-js-ext/vip-badge","https://www.npmjs.com/package/@drone-js-ext/vip-badge/v/1.0.1","https://www.npmjs.com/package/@drone-js-ext/vip-badge/v/0.0.1","https://www.npmjs.com/package/@drone-js-ext/vip-badge/v/2.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18277","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18277","identifiers":["MAL-2026-18277"]},"retained":false,"historicalAffected":[]}],"coverage":[]}