MAL-2026-14474

Dashboard / Malicious Package / MAL-2026-14474

MAL-2026-14474

Summary: Malicious code in ecobee-api (npm)

Details: Source: amazon-inspector (bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f) On `npm install`, ecobee-api runs `node beacon.js` via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint http://169.58.96.170:9001/cb, passing the installer's hostname (os.hostname()) and the package name as query parameters. The package ships no functional library code — package.json declares an UNLICENSED 'Utility package' with a name resembling the Ecobee vendor, and the only substantive shipped file is the beacon. This is the shape of a dependency-confusion / typosquat recon beacon: it confirms install-time code execution on the victim host and identifies the host to the operator of 169.58.96.170 over plain HTTP. Source: ghsa-malware (ff609de04cde8e0f5d78290f0da873acff7979ca715976ac8aa2b6d47f3a3dcb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://www.npmjs.com/package/ecobee-api/v/0.0.2, https://github.com/advisories/GHSA-v8ph-958r-cj9q, https://www.npmjs.com/package/ecobee-api/v/0.0.1