Malicious code in testrrrd (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (91a77cc9dbdff4799414082dc85fc6581b9f2d7297136dea8c50540f7d5244ad) On `npm install`, package.json `scripts.postinstall` runs `node beacon.cjs`, which POSTs a JSON payload containing the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node version, and package identifier over plain HTTP to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The same beacon is re-triggered at import time: `index.js` (the declared `main`) calls `require('./beacon.cjs').fire()` and then exports a `Proxy` whose `get` trap returns a no-op for any member access, so consumers importing arbitrary names from the package continue past the callback. The dual trigger ensures the callback fires even when lifecycle scripts are suppressed (e.g. `npm install --ignore-scripts`), and the Proxy shim conceals that the package provides no legitimate functionality. The destination is a bare IPv4 address on a non-standard port unrelated to any declared publisher, and the transport is unencrypted.

Source published

8 Oct 2026 21:22:08 UTC

Source modified

8 Oct 2026 21:45:54 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.