mal-2026-17775
Vulnerability from ossf_malicious_packages
Published
2026-10-11 13:51
Modified
2026-10-11 14:19
Summary
Malicious code in nitro-cjs-requirer (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b)
The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape — hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers — is a dependency-confusion or build-pipeline reconnaissance probe.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
Credits
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "beacon.cjs",
"sha256": "d3070b8fef42de65aef2a9ffe3b22d6c904520ded44be82ccd538fa7f507ec6c",
"tlsh": "ac3161eba8e0a008aaa67098c54f0409b17bf0078501af50fd5c82919f6153c33fa8dc"
},
{
"path": "index.js",
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
"tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
}
],
"package_integrity": [
{
"filename": "nitro-cjs-requirer-1.0.0.tgz",
"hashes": {
"sha1": "eeb3328db97869bb6fcab89219ad4904a0b9a856",
"sha512_sri": "sha512-nsakMiZ8uWjjxWcvNwXJEnbBtxRE8im4IDYK4x2lzi2sDxsZMLn5DSk/ivAF0midPbj8XpR8YX+s6LcLZHNs2Q=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "nitro-cjs-requirer"
},
"versions": [
"1.0.0",
"0.0.1",
"1.1.0",
"2.0.0",
"99.0.1",
"3.0.0"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-021409",
"import_time": "2026-10-11T14:18:03.234826964Z",
"modified_time": "2026-10-11T13:55:05Z",
"sha256": "1cddd06b2ec2f8f432460f051b96f64db2fd2eb3a5cca5966ce9987d93b84052",
"source": "amazon-inspector",
"versions": [
"1.0.0"
]
},
{
"id": "IN-MAL-2026-021440",
"import_time": "2026-10-11T14:18:06.186319166Z",
"modified_time": "2026-10-11T14:00:00Z",
"sha256": "b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b",
"source": "amazon-inspector",
"versions": [
"0.0.1"
]
},
{
"id": "IN-MAL-2026-021406",
"import_time": "2026-10-11T14:18:02.96104776Z",
"modified_time": "2026-10-11T13:54:35Z",
"sha256": "d3e330b9ba4b12d56187afb801280b4f629ecc2d8a6caa11ef8f19d39c5faff5",
"source": "amazon-inspector",
"versions": [
"1.1.0"
]
},
{
"id": "IN-MAL-2026-021405",
"import_time": "2026-10-11T14:18:02.893388264Z",
"modified_time": "2026-10-11T13:54:26Z",
"sha256": "e1aaec8fedc0d25e84befb8dc069e8ec1869376b50c9500ee0194fead42426f5",
"source": "amazon-inspector",
"versions": [
"2.0.0"
]
},
{
"id": "IN-MAL-2026-021383",
"import_time": "2026-10-11T14:18:01.136249744Z",
"modified_time": "2026-10-11T13:51:12Z",
"sha256": "f420c7a515f174ae453ff2bcfc84a554602d363bfd77aa4744f17deb6357ea11",
"source": "amazon-inspector",
"versions": [
"99.0.1"
]
},
{
"id": "IN-MAL-2026-021436",
"import_time": "2026-10-11T14:18:05.791497694Z",
"modified_time": "2026-10-11T13:59:21Z",
"sha256": "abf51a98bdcb0068cdfe0026958859bc27434945ffc1db815bd44bded7dfe114",
"source": "amazon-inspector",
"versions": [
"3.0.0"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b)\nThe package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape \u2014 hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers \u2014 is a dependency-confusion or build-pipeline reconnaissance probe.\n",
"id": "MAL-2026-17775",
"modified": "2026-10-11T14:19:59Z",
"published": "2026-10-11T13:51:12Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/nitro-cjs-requirer/v/1.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/nitro-cjs-requirer/v/0.0.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/nitro-cjs-requirer/v/1.1.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/nitro-cjs-requirer/v/2.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/nitro-cjs-requirer/v/99.0.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/nitro-cjs-requirer/v/3.0.0"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in nitro-cjs-requirer (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…