MAL-2026-17768

Dashboard / Malicious Package / MAL-2026-17768

MAL-2026-17768

Summary: Malicious code in cloudflare_module (npm)

Details: Source: amazon-inspector (f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242) Package `[email protected]` is a dependency-confusion lure targeting the `cloudflare_*` namespace. `package.json` declares `scripts.postinstall: "node beacon.cjs"`, and `beacon.cjs` POSTs a JSON payload containing `os.hostname()`, the install path (`__dirname`), `process.cwd()`, and `process.version` to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plain HTTP. The package `main` (`index.js`) additionally calls `require('./beacon.cjs').fire()` at top level inside a try/catch, so the same host-identifier POST also fires whenever a downstream bundler or application `require()`s the package. The default export is a Proxy that returns a no-op for every property access, allowing bundlers that resolve an internal `cloudflare_module` name to complete the build cleanly so the beacon callback fires without producing errors. The package is published at version `99.0.1` with a generic "Compatibility shim." description, consistent with version-bumping to beat an internal registry during resolution. The README self-labels the package as an "authorized dependency-confusion test," but the beacon targets any machine that resolves the name — the installer never consents to the exfiltration — and the destination is an unattributed bare-IP collector, not infrastructure of the targeted namespace.

References: https://www.npmjs.com/package/cloudflare_module/v/3.0.0, https://www.npmjs.com/package/cloudflare_module/v/1.0.1, https://www.npmjs.com/package/cloudflare_module/v/1.0.0, https://www.npmjs.com/package/cloudflare_module/v/99.0.1