MAL-2026-17704

    Dashboard / Malicious Package / MAL-2026-17704

    MAL-2026-17704

    Published: 8 Oct 2026Last Modified: 8 Oct 2026

    Summary: Malicious code in @wxwxtest/testrrrdd (npm)

    Details: Source: amazon-inspector (2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34) The package ships a postinstall script (`scripts.postinstall` runs `node beacon.cjs`) and a top-level `require('./beacon.cjs').fire()` in `index.js` that POST installer host metadata — hostname, install path, cwd, Node version, and package name — to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The exfiltration fires automatically both on `npm install` and on any `require()` of the package. `index.js` otherwise exports a Proxy returning no-op functions for any property access, so the package has no legitimate functionality; its sole effect is the callback to the hardcoded endpoint. The destination is not associated with any publisher domain and is unrelated to the self-described 'compatibility shim' purpose. The shape (stub Proxy export + install/require-time beacon to a bare-IP collector) is a dependency-confusion / typosquat proof-of-installation beacon.

    References: https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.1, https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.0, https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.0.1, https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/3.0.0, https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.1.0, https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.0, https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.1

    Affected packages

    Package

    Name: @wxwxtest/testrrrdd

    Purl: pkg:npm/%40wxwxtest/testrrrdd

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1
    2.0.0