MAL-2026-17774

Dashboard / Malicious Package / MAL-2026-17774

MAL-2026-17774

Summary: Malicious code in nitro-bundled-dep (npm)

Details: Source: amazon-inspector (893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622) The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname, install path, current working directory, and Node version — to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The beacon in beacon.cjs is invoked from package.json's postinstall script, so it fires automatically on `npm install`, and is also invoked from index.js so it fires again whenever the module is required. The main module exports a Proxy that returns no-op functions for any property access, allowing a victim build that imports this name to continue without errors after the beacon has executed — the shape of a dependency-confusion / name-squat payload whose purpose is to confirm successful code execution inside a target build environment and report host identifiers to an attacker-controlled collector.

References: https://www.npmjs.com/package/nitro-bundled-dep/v/99.0.1, https://www.npmjs.com/package/nitro-bundled-dep/v/2.0.1, https://www.npmjs.com/package/nitro-bundled-dep/v/1.1.0, https://www.npmjs.com/package/nitro-bundled-dep/v/0.0.1, https://www.npmjs.com/package/nitro-bundled-dep/v/1.0.0