Malicious code in troubleshooting (npm)
troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 7 versions, and 6 versions of browser-metrics-plugin.contrib with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (28103a0b6203c0917551439eb348f6b197e382fad4e84d9bf2cbaadd48012ccb) troubleshooting@2.0.1 is a stub package whose only functional behavior is a reconnaissance beacon. package.json declares `scripts.postinstall: node beacon.cjs`, which runs on `npm install`, and index.js runs the same beacon on `require('troubleshooting')` before exporting a Proxy whose properties all return no-ops so consuming bundlers do not crash. beacon.cjs collects the package name, `os.hostname()`, `__dirname` (install path), `process.cwd()`, and `process.version`, and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The README s
- Products
- troubleshooting
- Affected versions
- 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1
- Fixed versions
- Not specified
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 08:58 UTC · Revision 1
Source evidence
troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 7 versions, and 6 versions of browser-metrics-plugin.contrib with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (28103a0b6203c0917551439eb348f6b197e382fad4e84d9bf2cbaadd48012ccb) troubleshooting@2.0.1 is a stub package whose only functional behavior is a reconnaissance beacon. package.json declares `scripts.postinstall: node beacon.cjs`, which runs on `npm install`, and index.js runs the same beacon on `require('troubleshooting')` before exporting a Proxy whose properties all return no-ops so consuming bundlers do not crash. beacon.cjs collects the package name, `os.hostname()`, `__dirname` (install path), `process.cwd()`, and `process.version`, and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The README s
osv:MAL-2026-17641
troubleshooting
Fixed versions: Not specified
Complete source record
{
"id": "e31b423c78ac776a4c6368126eaeed7aae4100937b8d3f2ff7972bc01504c44e",
"url": "https://osv.dev/vulnerability/MAL-2026-17641",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Malicious code in troubleshooting (npm)",
"summary": "troubleshooting is a dependency-confusion package: it is described as a \"Compatibility shim\", uses version numbers up to 99.0.1, and its README calls it an \"authorized dependency-confusion test\". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 7 versions, and 6 versions of browser-metrics-plugin.contrib with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (28103a0b6203c0917551439eb348f6b197e382fad4e84d9bf2cbaadd48012ccb) troubleshooting@2.0.1 is a stub package whose only functional behavior is a reconnaissance beacon. package.json declares `scripts.postinstall: node beacon.cjs`, which runs on `npm install`, and index.js runs the same beacon on `require('troubleshooting')` before exporting a Proxy whose properties all return no-ops so consuming bundlers do not crash. beacon.cjs collects the package name, `os.hostname()`, `__dirname` (install path), `process.cwd()`, and `process.version`, and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The README s",
"evidence": "osv:MAL-2026-17641",
"products": [
{
"name": {
"value": "troubleshooting",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.1.0",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "99.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "1.1.0",
"evidence": "/affected/0/versions"
},
{
"value": "2.0.1",
"evidence": "/affected/0/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "MAL-2026-17641",
"aliases": [
"MAL-2026-17641"
],
"affected": [
{
"package": {
"name": "troubleshooting",
"purl": "pkg:npm/troubleshooting",
"ecosystem": "npm"
},
"versions": [
"0.1.0",
"1.0.0",
"1.0.1",
"99.0.1",
"3.0.0",
"1.1.0",
"2.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/troubleshooting/MAL-2026-17641.json",
"indicators": {
"evidence_files": [
{
"path": "beacon.cjs",
"tlsh": "363141eba8e1e0489aaa7098c54f1409f17bf4069501af54fd5c82955f6153c33fa8dc",
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
},
{
"path": "index.js",
"tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "2d771f0fdac3bda213237ca3ecd4925885e016e4",
"sha512_sri": "sha512-B8uhPtSmrwNhV6Tvx0G4SpqwXnvq8G0dnje4l170FYNsBJUVUYljg4/b9N2hAbJWIjp59/cS5lMm8tK+quHR+Q=="
},
"filename": "troubleshooting-1.0.1.tgz"
}
]
}
}
}
],
"modified": "2026-10-08T04:00:05.452128513Z",
"provider": "osv",
"references": [
"https://www.npmjs.com/package/troubleshooting",
"https://www.npmjs.com/package/troubleshooting/v/1.0.1",
"https://www.npmjs.com/package/troubleshooting/v/3.0.0",
"https://www.npmjs.com/package/troubleshooting/v/2.0.1",
"https://www.npmjs.com/package/troubleshooting/v/1.1.0",
"https://www.npmjs.com/package/troubleshooting/v/0.1.0",
"https://www.npmjs.com/package/troubleshooting/v/1.0.0",
"https://www.npmjs.com/package/troubleshooting/v/99.0.1"
],
"provider_metadata": {
"iocs": {
"ips": [
"185.158.107.175"
],
"urls": [
"http://185.158.107.175:8787/_ah/dc"
],
"files": [
{
"note": "Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions.",
"paths": [
"index.js"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (troubleshooting@0.1.0).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "e5915aacc7fbf292ba1eaf2f2cd242e9370d82342016eed6787b81f3b0c2415b"
}
},
{
"note": "Executed by the postinstall script of troubleshooting@0.1.0.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (troubleshooting@1.0.0).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "8bb61cf793d6a8a2ade875d08993c30016a890bdbae69eed7f828aa1a7ae1888"
}
},
{
"note": "Executed by the postinstall script of troubleshooting@1.0.0.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (troubleshooting@1.0.1).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "06a7b88c50c12888cc1c9278e10c6be42cc79cc7fad022fed434c9b34aef1fef"
}
},
{
"note": "Executed by the postinstall script of troubleshooting@1.0.1.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (troubleshooting@99.0.1).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "fbfeb7d0471481120cce111bfcd150660861075b267fd0d4a121498cfd1fd79c"
}
},
{
"note": "Executed by the postinstall script of troubleshooting@99.0.1.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (troubleshooting@3.0.0).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9e36b9e2858eef92b637abc885aedc7cc3a745511d9da85391c45da8f91e142e"
}
},
{
"note": "Executed by the postinstall script of troubleshooting@3.0.0.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (troubleshooting@1.1.0).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "a6b1f6c20b2ce88e11c467a0df7c8570b8d25c549aadd04affb37310647fc4b4"
}
},
{
"note": "Executed by the postinstall script of troubleshooting@1.1.0.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (troubleshooting@2.0.1).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "28058651eb58dd8ce81d910e706ed48c15aeaf3b4a0c2ffe789ad329742f434f"
}
},
{
"note": "Executed by the postinstall script of troubleshooting@2.0.1.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "9469c53670e67c2558a1cda35919a1cd8a44148b6697f639bbfeb6d1bef66531"
}
}
]
},
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-021120",
"sha256": "12b6f407e0af6cc239f1c478e20a35539c0fcfc55383b4c91bb28c8d761b6e0c",
"source": "amazon-inspector",
"versions": [
"1.0.1"
],
"import_time": "2026-10-08T03:50:29.235704196Z",
"modified_time": "2026-10-08T03:38:56Z"
},
{
"id": "IN-MAL-2026-021125",
"sha256": "1d90760032473b2d515d64b81a0a49c2c2721fe292e8202105b5c7ff2d9c62eb",
"source": "amazon-inspector",
"versions": [
"3.0.0"
],
"import_time": "2026-10-08T03:50:29.516676825Z",
"modified_time": "2026-10-08T03:39:42Z"
},
{
"id": "IN-MAL-2026-021123",
"sha256": "28103a0b6203c0917551439eb348f6b197e382fad4e84d9bf2cbaadd48012ccb",
"source": "amazon-inspector",
"versions": [
"2.0.1"
],
"import_time": "2026-10-08T03:50:29.406955779Z",
"modified_time": "2026-10-08T03:39:24Z"
},
{
"id": "IN-MAL-2026-021111",
"sha256": "2de8bb87c22c8d38bbe8802eda96645534386329c38faf8599659acd36f63f1f",
"source": "amazon-inspector",
"versions": [
"1.1.0"
],
"import_time": "2026-10-08T03:50:28.586907761Z",
"modified_time": "2026-10-08T03:37:38Z"
},
{
"id": "IN-MAL-2026-021127",
"sha256": "380314bcd4aa77f2a4ab4888c42977509fe75f3cd98dbaebfabee9c5802f94a3",
"source": "amazon-inspector",
"versions": [
"0.1.0"
],
"import_time": "2026-10-08T03:50:29.628697551Z",
"modified_time": "2026-10-08T03:39:58Z"
},
{
"id": "IN-MAL-2026-021122",
"sha256": "3f72779e9bac9b888cd1ce0469e24b47bb787ab79a82ae0a48a7197921699469",
"source": "amazon-inspector",
"versions": [
"1.0.0"
],
"import_time": "2026-10-08T03:50:29.342816973Z",
"modified_time": "2026-10-08T03:39:15Z"
},
{
"id": "IN-MAL-2026-021102",
"sha256": "528ab481d195c2bbda3a82684d945456dab74b48db46f90b5f65cb98b6d5a2ee",
"source": "amazon-inspector",
"versions": [
"99.0.1"
],
"import_time": "2026-10-08T03:50:28.00849661Z",
"modified_time": "2026-10-08T03:36:11Z"
}
]
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 98437,
"published_at": "2026-10-07T00:04:15+00:00"
}