Malicious code in xblaxw (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed) [email protected] is a stub package whose only behavior is a beacon. The package.json postinstall script runs `node beacon.cjs`, which collects host identifiers (hostname, install path, process.cwd(), process.version) and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plaintext HTTP. The same beacon is re-fired on require(): index.js exports a Proxy that returns a no-op function for any property access and calls require('./beacon.cjs').fire() on load, so the exfiltration also triggers whenever a consumer imports the package. The package description is 'Compatibility shim.' with no real functionality — the Proxy-of-noops export is consistent with a dependency-confusion / name-squat beacon designed to confirm which internal names resolve to this public package and report back installer host metadata to the operator at 185.158.107.175:8787.

Source published

8 Oct 2026 21:19:20 UTC

Source modified

8 Oct 2026 21:45:54 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.