Skip to content
Heist/ feed
Unrated

Malicious code in ph-common (npm)

Type: advisorySource: OSV1 source record

ph-common is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise979 published these 8 versions on 2026-10-05 between 02:09 and 02:16 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2) The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing

Announced Source revision 1
Original source ↗

MAL-2026-1809

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-1809

ph-common

Source reference: /affected/0/package/name

Affected versions
77.7.7

Source reference: /affected/0/versions

1.1.0

Source reference: /affected/0/versions

0.1.0

Source reference: /affected/0/versions

1.0.0

Source reference: /affected/0/versions

99.0.1

Source reference: /affected/0/versions

2.0.1

Source reference: /affected/0/versions

1.0.1

Source reference: /affected/0/versions

3.0.0

Source reference: /affected/0/versions

2.0.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "ph-common",
      "purl": "pkg:npm/ph-common",
      "ecosystem": "npm"
    },
    "versions": [
      "77.7.7",
      "1.1.0",
      "0.1.0",
      "1.0.0",
      "99.0.1",
      "2.0.1",
      "1.0.1",
      "3.0.0",
      "2.0.0"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ph-common/MAL-2026-1809.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "beacon.cjs",
            "tlsh": "2f314feba8e1a048aaaa7498c54f1409b27af4079501ab50f95c92959f6193c33fa8dc",
            "sha256": "6637c35c8c7345f4b304050ed38308261b0098b7034745fb5a9a6b8ba23e4b6c"
          },
          {
            "path": "index.js",
            "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
            "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "3b29232f4cf830444c731280a88545fcb3904597",
              "sha512_sri": "sha512-qXYW44dtByDSdH1p1nsWUqFC0MkC6Q/f3ybsViWox6dLaWuN81ZGg30M1iME5OLUS935kNT2pRPzrF24qf8LFg=="
            },
            "filename": "ph-common-1.1.0.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#85923 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement