Malicious code in nitro-bundled-dep (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622) The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname, install path, current working directory, and Node version — to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The beacon in beacon.cjs is invoked from package.json's postinstall script, so it fires automatically on `npm install`, and is also invoked from index.js so it fires again whenever the module is required. The main module exports a Proxy that returns no-op functions for any property access, allowing a victim build that imports this name to continue without errors after the beacon has executed — the shape of a dependency-confusion / name-squat payload whose purpose is to confirm successful code execution inside a target build environment and report host identifiers to an attacker-controlled collector.

Source published

11 Oct 2026 13:50:38 UTC

Source modified

12 Oct 2026 14:30:19 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.