Malicious code in ph-common (npm)
ph-common is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise979 published these 8 versions on 2026-10-05 between 02:09 and 02:16 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2) The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing
MAL-2026-1809
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-1809
ph-common
Source reference: /affected/0/package/name
- Affected versions
- 77.7.7
Source reference:
/affected/0/versions1.1.0Source reference:
/affected/0/versions0.1.0Source reference:
/affected/0/versions1.0.0Source reference:
/affected/0/versions99.0.1Source reference:
/affected/0/versions2.0.1Source reference:
/affected/0/versions1.0.1Source reference:
/affected/0/versions3.0.0Source reference:
/affected/0/versions2.0.0Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "ph-common",
"purl": "pkg:npm/ph-common",
"ecosystem": "npm"
},
"versions": [
"77.7.7",
"1.1.0",
"0.1.0",
"1.0.0",
"99.0.1",
"2.0.1",
"1.0.1",
"3.0.0",
"2.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ph-common/MAL-2026-1809.json",
"indicators": {
"evidence_files": [
{
"path": "beacon.cjs",
"tlsh": "2f314feba8e1a048aaaa7498c54f1409b27af4079501ab50f95c92959f6193c33fa8dc",
"sha256": "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
},
{
"path": "index.js",
"tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "3b29232f4cf830444c731280a88545fcb3904597",
"sha512_sri": "sha512-qXYW44dtByDSdH1p1nsWUqFC0MkC6Q/f3ybsViWox6dLaWuN81ZGg30M1iME5OLUS935kNT2pRPzrF24qf8LFg=="
},
"filename": "ph-common-1.1.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #85923 · Revision 1
- Added to Heist Feed
- Publisher date