Malicious code in @ecg-internal/js-react-i18n (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e) The package is published under an internal-looking scope (@ecg-internal) and ships a stub main module that returns a Proxy of no-op functions for every property access — it provides none of the i18n functionality its name implies. Its only real behavior is firing beacon.cjs, which executes both from the declared postinstall lifecycle script (`node beacon.cjs`) and from a top-level `require('./beacon.cjs').fire()` in the main module. beacon.cjs collects the installer's hostname (via `os.hostname()`), install path (`__dirname`), current working directory, Node.js version, and package name, and POSTs them over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not a publisher-aligned domain and the shape — internal-looking scope + hollow functional surface + install- and import-time callback with host identifiers to a bare IP — is a dependency-confusion reconnaissance probe designed to identify internal build systems that resolve the private name from the public registry. ## Source: ghsa-malware (4b6637975491d2cb9a6fe062dab13216afeeeda88e533e8cfde6d628df841bf5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be r
- Products
- @ecg-internal/js-react-i18n
- Affected versions
- 1.0.0, 1.0.1, 1.1.0, 2.0.0, 99.0.1
- Fixed versions
- Not specified
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:41 UTC · Revision 1
Source evidence
Malicious code in @ecg-internal/js-react-i18n (npm)
core-osv · Original sourcePublished 23 Oct 2026, 02:01 UTC
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e) The package is published under an internal-looking scope (@ecg-internal) and ships a stub main module that returns a Proxy of no-op functions for every property access — it provides none of the i18n functionality its name implies. Its only real behavior is firing beacon.cjs, which executes both from the declared postinstall lifecycle script (`node beacon.cjs`) and from a top-level `require('./beacon.cjs').fire()` in the main module. beacon.cjs collects the installer's hostname (via `os.hostname()`), install path (`__dirname`), current working directory, Node.js version, and package name, and POSTs them over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not a publisher-aligned domain and the shape — internal-looking scope + hollow functional surface + install- and import-time callback with host identifiers to a bare IP — is a dependency-confusion reconnaissance probe designed to identify internal build systems that resolve the private name from the public registry. ## Source: ghsa-malware (4b6637975491d2cb9a6fe062dab13216afeeeda88e533e8cfde6d628df841bf5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be r
osv:MAL-2026-18209
@ecg-internal/js-react-i18n
Fixed versions: Not specified
Complete source record
{
"id": "33b3b2824d4d47a7ac438dd15efe5e9b6c3863e6db3c0693c622d22ba3d3c2f5",
"url": "https://osv.dev/vulnerability/MAL-2026-18209",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Malicious code in @ecg-internal/js-react-i18n (npm)",
"summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e) The package is published under an internal-looking scope (@ecg-internal) and ships a stub main module that returns a Proxy of no-op functions for every property access — it provides none of the i18n functionality its name implies. Its only real behavior is firing beacon.cjs, which executes both from the declared postinstall lifecycle script (`node beacon.cjs`) and from a top-level `require('./beacon.cjs').fire()` in the main module. beacon.cjs collects the installer's hostname (via `os.hostname()`), install path (`__dirname`), current working directory, Node.js version, and package name, and POSTs them over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not a publisher-aligned domain and the shape — internal-looking scope + hollow functional surface + install- and import-time callback with host identifiers to a bare IP — is a dependency-confusion reconnaissance probe designed to identify internal build systems that resolve the private name from the public registry. ## Source: ghsa-malware (4b6637975491d2cb9a6fe062dab13216afeeeda88e533e8cfde6d628df841bf5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be r",
"evidence": "osv:MAL-2026-18209",
"products": [
{
"name": {
"value": "@ecg-internal/js-react-i18n",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "1.1.0",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "99.0.1",
"evidence": "/affected/0/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "MAL-2026-18209",
"aliases": [
"GHSA-5x9g-7rj9-4xc8",
"MAL-2026-18209"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@ecg-internal/js-react-i18n",
"purl": "pkg:npm/%40ecg-internal/js-react-i18n",
"ecosystem": "npm"
},
"versions": [
"2.0.0",
"1.1.0",
"1.0.1",
"1.0.0",
"99.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ecg-internal/js-react-i18n/MAL-2026-18209.json",
"indicators": {
"evidence_files": [
{
"path": "beacon.cjs",
"tlsh": "e93161eba8f1a0489aa77498c54f1409b17af0078401ab54f95c82955f7257c33fa8dc",
"sha256": "ef93c814d488958e37b2a6bfdf70138e333d45a1bec1a5503954b6c54d57c34c"
},
{
"path": "index.js",
"tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "4248845c66afbb187ec3379ef57c69839a60576e",
"sha512_sri": "sha512-Sxm+bIvQ2CO6izpq+I5AOHAN4Wx4Tg9uDnNdXmtexsbAf29TsHEQHZI1+jjMWKeDaOeDSm5eejxsgizzkpTD7g=="
},
"filename": "js-react-i18n-2.0.0.tgz"
}
]
}
}
}
],
"modified": "2026-10-23T02:45:04.249876136Z",
"provider": "osv",
"references": [
"https://www.npmjs.com/package/@ecg-internal/js-react-i18n/v/2.0.0",
"https://www.npmjs.com/package/@ecg-internal/js-react-i18n/v/1.1.0",
"https://www.npmjs.com/package/@ecg-internal/js-react-i18n/v/1.0.1",
"https://www.npmjs.com/package/@ecg-internal/js-react-i18n/v/1.0.0",
"https://www.npmjs.com/package/@ecg-internal/js-react-i18n/v/99.0.1",
"https://github.com/advisories/GHSA-5x9g-7rj9-4xc8"
],
"provider_metadata": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-021616",
"sha256": "4bdcd9582309ab36ac36d7408b1d15fa68f9a1e7830e00840f122dfd2951f693",
"source": "amazon-inspector",
"versions": [
"2.0.0"
],
"import_time": "2026-10-23T02:25:39.769680242Z",
"modified_time": "2026-10-23T02:02:09Z"
},
{
"id": "IN-MAL-2026-021614",
"sha256": "52b3d7654df458abdeead84eb9031600002457377e7448941df461e4cbe581eb",
"source": "amazon-inspector",
"versions": [
"1.1.0"
],
"import_time": "2026-10-23T02:25:39.667037481Z",
"modified_time": "2026-10-23T02:01:54Z"
},
{
"id": "IN-MAL-2026-021617",
"sha256": "533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e",
"source": "amazon-inspector",
"versions": [
"1.0.1"
],
"import_time": "2026-10-23T02:25:39.824364147Z",
"modified_time": "2026-10-23T02:02:17Z"
},
{
"id": "IN-MAL-2026-021613",
"sha256": "f5cf1eb6b3e96820660cc882257dc1babe6bd32b038887dfa88c8c415224f329",
"source": "amazon-inspector",
"versions": [
"1.0.0"
],
"import_time": "2026-10-23T02:25:39.600415536Z",
"modified_time": "2026-10-23T02:01:46Z"
},
{
"id": "IN-MAL-2026-021615",
"sha256": "4c4aa9281580d6160a62c42077eeb52590ce56a0789ae03b2235a172c5404dd7",
"source": "amazon-inspector",
"versions": [
"99.0.1"
],
"import_time": "2026-10-23T02:25:39.707416504Z",
"modified_time": "2026-10-23T02:02:03Z"
},
{
"id": "GHSA-5x9g-7rj9-4xc8",
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"sha256": "4b6637975491d2cb9a6fe062dab13216afeeeda88e533e8cfde6d628df841bf5",
"source": "ghsa-malware",
"import_time": "2026-10-23T02:36:25.365568405Z",
"modified_time": "2026-10-23T02:05:20Z"
}
]
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 411756,
"published_at": "2026-10-23T02:01:46+00:00"
}