MAL-2026-17706

Dashboard / Malicious Package / MAL-2026-17706

MAL-2026-17706

Summary: Malicious code in testrrrd (npm)

Details: Source: amazon-inspector (91a77cc9dbdff4799414082dc85fc6581b9f2d7297136dea8c50540f7d5244ad) On `npm install`, package.json `scripts.postinstall` runs `node beacon.cjs`, which POSTs a JSON payload containing the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node version, and package identifier over plain HTTP to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The same beacon is re-triggered at import time: `index.js` (the declared `main`) calls `require('./beacon.cjs').fire()` and then exports a `Proxy` whose `get` trap returns a no-op for any member access, so consumers importing arbitrary names from the package continue past the callback. The dual trigger ensures the callback fires even when lifecycle scripts are suppressed (e.g. `npm install --ignore-scripts`), and the Proxy shim conceals that the package provides no legitimate functionality. The destination is a bare IPv4 address on a non-standard port unrelated to any declared publisher, and the transport is unencrypted.

References: https://www.npmjs.com/package/testrrrd/v/1.0.0, https://www.npmjs.com/package/testrrrd/v/0.0.1, https://www.npmjs.com/package/testrrrd/v/3.0.0, https://www.npmjs.com/package/testrrrd/v/99.0.1, https://www.npmjs.com/package/testrrrd/v/2.0.1, https://www.npmjs.com/package/testrrrd/v/1.1.0, https://www.npmjs.com/package/testrrrd/v/2.0.0