Malicious code in cloudflare_module (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242) Package `[email protected]` is a dependency-confusion lure targeting the `cloudflare_*` namespace. `package.json` declares `scripts.postinstall: "node beacon.cjs"`, and `beacon.cjs` POSTs a JSON payload containing `os.hostname()`, the install path (`__dirname`), `process.cwd()`, and `process.version` to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plain HTTP. The package `main` (`index.js`) additionally calls `require('./beacon.cjs').fire()` at top level inside a try/catch, so the same host-identifier POST also fires whenever a downstream bundler or application `require()`s the package. The default export is a Proxy that returns a no-op for every property access, allowing bundlers that resolve an internal `cloudflare_module` name to complete the build cleanly so the beacon callback fires without producing errors. The package is published at version `99.0.1` with a generic "Compatibility shim." description, consistent with version-bumping to beat an internal registry during resolution. The README self-labels the package as an "authorized dependency-confusion test," but the beacon targets any machine that resolves the name — the installer never consents to the exfiltration — and the destination is an unattributed bare-IP collector, not infrastructure of the targeted namespace.

Source published

11 Oct 2026 13:51:50 UTC

Source modified

11 Oct 2026 17:30:47 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.