MAL-2026-17704
Vulnerability from ossf_malicious_packages
Published
2026-10-08 21:21
Modified
2026-10-08 21:44
Summary
Malicious code in @wxwxtest/testrrrdd (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34)
The package ships a postinstall script (scripts.postinstall runs node beacon.cjs) and a top-level require('./beacon.cjs').fire() in index.js that POST installer host metadata — hostname, install path, cwd, Node version, and package name — to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The exfiltration fires automatically both on npm install and on any require() of the package. index.js otherwise exports a Proxy returning no-op functions for any property access, so the package has no legitimate functionality; its sole effect is the callback to the hardcoded endpoint. The destination is not associated with any publisher domain and is unrelated to the self-described 'compatibility shim' purpose. The shape (stub Proxy export + install/require-time beacon to a bare-IP collector) is a dependency-confusion / typosquat proof-of-installation beacon.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
Credits
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "beacon.cjs",
"sha256": "b90b0687de31609c4a0ed88db0d1979d33b510ec8e772abc2102b169766f09e7",
"tlsh": "3f3161eba8f1a0489aa77098c54f0409f17bf0068401ab50f95c82955f6153c33fa8dc"
},
{
"path": "index.js",
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
"tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
}
],
"package_integrity": [
{
"filename": "testrrrdd-2.0.1.tgz",
"hashes": {
"sha1": "f15a8241a11d830a39d4a0aa33a42d8a61d5a80c",
"sha512_sri": "sha512-oZCcmW2AH5v1a7iMachtLDnfIVWvO2xnVOibjbAuMDtV4BSo+jr3XyQW8moa1MyMWrxL8NWa3yJHB2J3RuUatA=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "@wxwxtest/testrrrdd"
},
"versions": [
"2.0.1",
"2.0.0",
"0.0.1",
"3.0.0",
"0.1.0",
"1.0.0",
"1.0.1"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-021268",
"import_time": "2026-10-08T21:42:57.762614731Z",
"modified_time": "2026-10-08T21:23:51Z",
"sha256": "093f62f129fa3bb6fb05829e930449393d54a9d5e72a5188aaa542a26b0ce368",
"source": "amazon-inspector",
"versions": [
"2.0.1"
]
},
{
"id": "IN-MAL-2026-021252",
"import_time": "2026-10-08T21:42:56.519207066Z",
"modified_time": "2026-10-08T21:21:34Z",
"sha256": "4a04b2b4f02f5d06a3729f210aa1ec9844c54ad8b1653677fc6e3d62e7f18549",
"source": "amazon-inspector",
"versions": [
"2.0.0"
]
},
{
"id": "IN-MAL-2026-021253",
"import_time": "2026-10-08T21:42:56.623622268Z",
"modified_time": "2026-10-08T21:21:42Z",
"sha256": "73ce932992891761028144293d7b2e414208fee2695adccf3d09bbd8751f3f79",
"source": "amazon-inspector",
"versions": [
"0.0.1"
]
},
{
"id": "IN-MAL-2026-021255",
"import_time": "2026-10-08T21:42:56.780389011Z",
"modified_time": "2026-10-08T21:22:00Z",
"sha256": "e194808ec33e50a585181e38b0359bd1f04e848fd87aa06c6bca80bbde2a50a7",
"source": "amazon-inspector",
"versions": [
"3.0.0"
]
},
{
"id": "IN-MAL-2026-021251",
"import_time": "2026-10-08T21:42:56.457783297Z",
"modified_time": "2026-10-08T21:21:26Z",
"sha256": "e7fce4d8536bf6254aa0791b2d048874ea7cc153303b68e28aa7e296493b342e",
"source": "amazon-inspector",
"versions": [
"0.1.0"
]
},
{
"id": "IN-MAL-2026-021269",
"import_time": "2026-10-08T21:42:57.845095126Z",
"modified_time": "2026-10-08T21:23:58Z",
"sha256": "0e87a3919d1aeb1d6b9f3069d72f5098fe92fbafc821448753dc650745ff0f62",
"source": "amazon-inspector",
"versions": [
"1.0.0"
]
},
{
"id": "IN-MAL-2026-021250",
"import_time": "2026-10-08T21:42:56.358827821Z",
"modified_time": "2026-10-08T21:21:17Z",
"sha256": "2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34",
"source": "amazon-inspector",
"versions": [
"1.0.1"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34)\nThe package ships a postinstall script (`scripts.postinstall` runs `node beacon.cjs`) and a top-level `require(\u0027./beacon.cjs\u0027).fire()` in `index.js` that POST installer host metadata \u2014 hostname, install path, cwd, Node version, and package name \u2014 to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The exfiltration fires automatically both on `npm install` and on any `require()` of the package. `index.js` otherwise exports a Proxy returning no-op functions for any property access, so the package has no legitimate functionality; its sole effect is the callback to the hardcoded endpoint. The destination is not associated with any publisher domain and is unrelated to the self-described \u0027compatibility shim\u0027 purpose. The shape (stub Proxy export + install/require-time beacon to a bare-IP collector) is a dependency-confusion / typosquat proof-of-installation beacon.\n",
"id": "MAL-2026-17704",
"modified": "2026-10-08T21:44:45Z",
"published": "2026-10-08T21:21:17Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.0.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/3.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.1.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.1"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in @wxwxtest/testrrrdd (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…