Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in xblaxw (npm)

Type: advisorySources: OSV

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed) xblaxw@1.1.0 is a stub package whose only behavior is a beacon. The package.json postinstall script runs `node beacon.cjs`, which collects host identifiers (hostname, install path, process.cwd(), process.version) and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plaintext HTTP. The same beacon is re-fired on require(): index.js exports a Proxy that returns a no-op function for any property access and calls require('./beacon.cjs').fire() on load, so the exfiltration also triggers whenever a consumer imports the package. The package description is 'Compatibility shim.' with no real functionality — the Proxy-of-noops export is consistent with a dependency-confusion / name-squat beacon designed to confirm which internal names resolve to this public package and report back installer host metadata to the operator at 185.158.107.175:8787.

Products
xblaxw
Affected versions
1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
28 Oct 2026, 10:06 UTC · Revision 1

Source evidence

Malicious code in xblaxw (npm)

core-osv · Original source

Published 8 Oct 2026, 21:19 UTC

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed) xblaxw@1.1.0 is a stub package whose only behavior is a beacon. The package.json postinstall script runs `node beacon.cjs`, which collects host identifiers (hostname, install path, process.cwd(), process.version) and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plaintext HTTP. The same beacon is re-fired on require(): index.js exports a Proxy that returns a no-op function for any property access and calls require('./beacon.cjs').fire() on load, so the exfiltration also triggers whenever a consumer imports the package. The package description is 'Compatibility shim.' with no real functionality — the Proxy-of-noops export is consistent with a dependency-confusion / name-squat beacon designed to confirm which internal names resolve to this public package and report back installer host metadata to the operator at 185.158.107.175:8787.

osv:MAL-2026-17708

xblaxw

Fixed versions: Not specified

Complete source record
{
  "id": "ec251a4abf88a5f1df0c81a28aef40517511d03e2060fbb95381548d7c06bfc8",
  "url": "https://osv.dev/vulnerability/MAL-2026-17708",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in xblaxw (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed) xblaxw@1.1.0 is a stub package whose only behavior is a beacon. The package.json postinstall script runs `node beacon.cjs`, which collects host identifiers (hostname, install path, process.cwd(), process.version) and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plaintext HTTP. The same beacon is re-fired on require(): index.js exports a Proxy that returns a no-op function for any property access and calls require('./beacon.cjs').fire() on load, so the exfiltration also triggers whenever a consumer imports the package. The package description is 'Compatibility shim.' with no real functionality — the Proxy-of-noops export is consistent with a dependency-confusion / name-squat beacon designed to confirm which internal names resolve to this public package and report back installer host metadata to the operator at 185.158.107.175:8787.",
    "evidence": "osv:MAL-2026-17708",
    "products": [
      {
        "name": {
          "value": "xblaxw",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "99.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "3.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17708",
      "aliases": [
        "MAL-2026-17708"
      ],
      "affected": [
        {
          "package": {
            "name": "xblaxw",
            "purl": "pkg:npm/xblaxw",
            "ecosystem": "npm"
          },
          "versions": [
            "2.0.0",
            "1.0.1",
            "99.0.1",
            "1.0.0",
            "2.0.1",
            "3.0.0",
            "1.1.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xblaxw/MAL-2026-17708.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "beacon.cjs",
                  "tlsh": "73314feba8e1a048aaab7098c54f1409b27bf4069501ab50f95c82959f6193c37fa8dc",
                  "sha256": "d8ec492e8a5266515bc6103067a07f98dc8644824089b9d32a14a435f43812ea"
                },
                {
                  "path": "index.js",
                  "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
                  "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "2ccb9289a71752b71ab3b25e95109f500d5b1f20",
                    "sha512_sri": "sha512-Ms4jzKOM6QhgbT2ocpg4gWEl6sOFpEpgqVHxk5FNZ0s3eo375LcQV95VtGYpJCaBrwWGO0VIVQSeY3+TMj5vDg=="
                  },
                  "filename": "xblaxw-2.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T21:45:54.261495414Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/xblaxw/v/2.0.0",
        "https://www.npmjs.com/package/xblaxw/v/1.0.1",
        "https://www.npmjs.com/package/xblaxw/v/99.0.1",
        "https://www.npmjs.com/package/xblaxw/v/1.0.0",
        "https://www.npmjs.com/package/xblaxw/v/2.0.1",
        "https://www.npmjs.com/package/xblaxw/v/3.0.0",
        "https://www.npmjs.com/package/xblaxw/v/1.1.0"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021236",
            "sha256": "110314989632807fad14e5fd2256199e22923b20df9f841ef8cce1480f13a693",
            "source": "amazon-inspector",
            "versions": [
              "2.0.0"
            ],
            "import_time": "2026-10-08T21:42:55.246922945Z",
            "modified_time": "2026-10-08T21:19:20Z"
          },
          {
            "id": "IN-MAL-2026-021241",
            "sha256": "992dbd421e3f64461b699aa41190af6729174ecf2a179e5986aa8c638bea4ba7",
            "source": "amazon-inspector",
            "versions": [
              "1.0.1"
            ],
            "import_time": "2026-10-08T21:42:55.661724691Z",
            "modified_time": "2026-10-08T21:20:02Z"
          },
          {
            "id": "IN-MAL-2026-021265",
            "sha256": "a67740f8c8fac71eb25c053bf07b93f3bc7b699aca1889831c2d64633e4f9d45",
            "source": "amazon-inspector",
            "versions": [
              "99.0.1"
            ],
            "import_time": "2026-10-08T21:42:57.54914459Z",
            "modified_time": "2026-10-08T21:23:29Z"
          },
          {
            "id": "IN-MAL-2026-021240",
            "sha256": "cc6a7f374924e3a4dc464dff2a51b6e916645280b776768d77fce9b0cd060045",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-08T21:42:55.57240259Z",
            "modified_time": "2026-10-08T21:19:52Z"
          },
          {
            "id": "IN-MAL-2026-021244",
            "sha256": "e92f858a6d813c2230dd5be0f27dba62ea7a966f1993443ebdd319b6d2a6da2c",
            "source": "amazon-inspector",
            "versions": [
              "2.0.1"
            ],
            "import_time": "2026-10-08T21:42:55.864824696Z",
            "modified_time": "2026-10-08T21:20:27Z"
          },
          {
            "id": "IN-MAL-2026-021242",
            "sha256": "19bf74581564f1973f91f22b5ec0c562ba39e57b339306745910dba75f3a9367",
            "source": "amazon-inspector",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-10-08T21:42:55.743016201Z",
            "modified_time": "2026-10-08T21:20:09Z"
          },
          {
            "id": "IN-MAL-2026-021243",
            "sha256": "2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed",
            "source": "amazon-inspector",
            "versions": [
              "1.1.0"
            ],
            "import_time": "2026-10-08T21:42:55.804275513Z",
            "modified_time": "2026-10-08T21:20:17Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 104760,
  "published_at": "2026-10-08T21:19:20+00:00"
}