Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in @grabcad/grabcad-shop-shared (npm)

Type: advisorySources: OSV

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889) The package publishes under the `@grabcad` scope but provides no real functionality: `index.js` exports a Proxy stub that no-ops every property access, and the package self-describes as a 'Compatibility shim'. A `postinstall` hook runs `node beacon.cjs`, and `index.js` also invokes the same `fire()` routine on require. `beacon.cjs` POSTs a JSON payload containing the package name, `os.hostname()`, `__dirname` (install path), `process.cwd()`, and `process.version` to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plaintext HTTP. The combination of a scope-matching stub plus install-time and require-time reconnaissance to a non-registry, non-publisher bare-IP destination is the canonical dependency-confusion recon pattern: the stub lets a consumer build succeed silently after accidentally resolving this package instead of an internal `@grabcad` package, while the beacon discloses the victim's hostname, project path, and runtime to the operator for follow-on targeting. ## Source: ghsa-malware (a203fc8f822b4a379a4c171a28188fc39cc94062beac427fc9069aca6df144b7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full contro

Products
@grabcad/grabcad-shop-shared
Affected versions
1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 03:12 UTC · Revision 1

Source evidence

Malicious code in @grabcad/grabcad-shop-shared (npm)

core-osv · Original source

Published 23 Oct 2026, 02:05 UTC

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889) The package publishes under the `@grabcad` scope but provides no real functionality: `index.js` exports a Proxy stub that no-ops every property access, and the package self-describes as a 'Compatibility shim'. A `postinstall` hook runs `node beacon.cjs`, and `index.js` also invokes the same `fire()` routine on require. `beacon.cjs` POSTs a JSON payload containing the package name, `os.hostname()`, `__dirname` (install path), `process.cwd()`, and `process.version` to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plaintext HTTP. The combination of a scope-matching stub plus install-time and require-time reconnaissance to a non-registry, non-publisher bare-IP destination is the canonical dependency-confusion recon pattern: the stub lets a consumer build succeed silently after accidentally resolving this package instead of an internal `@grabcad` package, while the beacon discloses the victim's hostname, project path, and runtime to the operator for follow-on targeting. ## Source: ghsa-malware (a203fc8f822b4a379a4c171a28188fc39cc94062beac427fc9069aca6df144b7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full contro

osv:MAL-2026-18215

@grabcad/grabcad-shop-shared

Fixed versions: Not specified

Complete source record
{
  "id": "cf3ea847e535ee518871c1f828d07e2665281b7d9e282b87fb7ac7b6a467269a",
  "url": "https://osv.dev/vulnerability/MAL-2026-18215",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @grabcad/grabcad-shop-shared (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889) The package publishes under the `@grabcad` scope but provides no real functionality: `index.js` exports a Proxy stub that no-ops every property access, and the package self-describes as a 'Compatibility shim'. A `postinstall` hook runs `node beacon.cjs`, and `index.js` also invokes the same `fire()` routine on require. `beacon.cjs` POSTs a JSON payload containing the package name, `os.hostname()`, `__dirname` (install path), `process.cwd()`, and `process.version` to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plaintext HTTP. The combination of a scope-matching stub plus install-time and require-time reconnaissance to a non-registry, non-publisher bare-IP destination is the canonical dependency-confusion recon pattern: the stub lets a consumer build succeed silently after accidentally resolving this package instead of an internal `@grabcad` package, while the beacon discloses the victim's hostname, project path, and runtime to the operator for follow-on targeting. ## Source: ghsa-malware (a203fc8f822b4a379a4c171a28188fc39cc94062beac427fc9069aca6df144b7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full contro",
    "evidence": "osv:MAL-2026-18215",
    "products": [
      {
        "name": {
          "value": "@grabcad/grabcad-shop-shared",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "3.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "99.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-18215",
      "aliases": [
        "GHSA-cc6r-jh8f-6c76",
        "MAL-2026-18215"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "@grabcad/grabcad-shop-shared",
            "purl": "pkg:npm/%40grabcad/grabcad-shop-shared",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.1",
            "2.0.1",
            "2.0.0",
            "3.0.0",
            "1.0.0",
            "99.0.1",
            "1.1.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@grabcad/grabcad-shop-shared/MAL-2026-18215.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "beacon.cjs",
                  "tlsh": "e03161ffa8e0a008aaab7098d54f0409b17af4069501ab50f95c83915f6257c33fa8dc",
                  "sha256": "eeb90ceb1b3e4732dc45d511ace29bc69b22beab22b22764e0c4daf13c3866fe"
                },
                {
                  "path": "index.js",
                  "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
                  "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "e61ee23d2afa12410d138c188a17fd233bcc2747",
                    "sha512_sri": "sha512-MoDtb+pvWKN5qBCSidKpycARJmAPcC8IO1dI14Pp+NqbbwOltbV3gcz9EuSyZgnnQTzLapF3dubVkXshpZhErg=="
                  },
                  "filename": "grabcad-shop-shared-1.0.1.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-23T20:30:05.013954514Z",
      "provider": "osv",
      "references": [
        "https://github.com/advisories/GHSA-cc6r-jh8f-6c76",
        "https://www.npmjs.com/package/@grabcad/grabcad-shop-shared/v/1.0.1",
        "https://www.npmjs.com/package/@grabcad/grabcad-shop-shared/v/2.0.1",
        "https://www.npmjs.com/package/@grabcad/grabcad-shop-shared/v/2.0.0",
        "https://www.npmjs.com/package/@grabcad/grabcad-shop-shared/v/3.0.0",
        "https://www.npmjs.com/package/@grabcad/grabcad-shop-shared/v/1.0.0",
        "https://www.npmjs.com/package/@grabcad/grabcad-shop-shared/v/99.0.1",
        "https://www.npmjs.com/package/@grabcad/grabcad-shop-shared/v/1.1.0"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "GHSA-cc6r-jh8f-6c76",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "a203fc8f822b4a379a4c171a28188fc39cc94062beac427fc9069aca6df144b7",
            "source": "ghsa-malware",
            "import_time": "2026-10-23T02:36:25.374852522Z",
            "modified_time": "2026-10-23T02:05:25Z"
          },
          {
            "id": "IN-MAL-2026-021619",
            "sha256": "72513dcd26e46a04ed08ff948414a6f38e00e70da2e1fb6561c91d226fe4ac63",
            "source": "amazon-inspector",
            "versions": [
              "1.0.1"
            ],
            "import_time": "2026-10-23T20:18:04.921030332Z",
            "modified_time": "2026-10-23T19:52:44Z"
          },
          {
            "id": "IN-MAL-2026-021623",
            "sha256": "73fbf3700f0a35439b12919017138bae04d46b18b2131608e4d475710198327b",
            "source": "amazon-inspector",
            "versions": [
              "2.0.1"
            ],
            "import_time": "2026-10-23T20:18:05.243397297Z",
            "modified_time": "2026-10-23T19:53:16Z"
          },
          {
            "id": "IN-MAL-2026-021620",
            "sha256": "80d5f7009ec0f08b1a490212c3e8d1f6ec00a36f3809e9583c5cbe78870351d0",
            "source": "amazon-inspector",
            "versions": [
              "2.0.0"
            ],
            "import_time": "2026-10-23T20:18:05.066616748Z",
            "modified_time": "2026-10-23T19:52:52Z"
          },
          {
            "id": "IN-MAL-2026-021641",
            "sha256": "8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889",
            "source": "amazon-inspector",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-10-23T20:18:06.4351597Z",
            "modified_time": "2026-10-23T19:55:39Z"
          },
          {
            "id": "IN-MAL-2026-021622",
            "sha256": "e2b214001f3e3033e291ebad45e1f472fdce6de0e2d8a20a128647f8c94b3158",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-23T20:18:05.191900148Z",
            "modified_time": "2026-10-23T19:53:06Z"
          },
          {
            "id": "IN-MAL-2026-021639",
            "sha256": "eccac762dcd1c6b43111aa7802b5978f88240ad505e4524cceec45016df758f2",
            "source": "amazon-inspector",
            "versions": [
              "99.0.1"
            ],
            "import_time": "2026-10-23T20:18:06.265495243Z",
            "modified_time": "2026-10-23T19:55:22Z"
          },
          {
            "id": "IN-MAL-2026-021621",
            "sha256": "431547a8d21447a34b49d27449f25ccc13120e47a6aebca2ccd3838bf8c9edce",
            "source": "amazon-inspector",
            "versions": [
              "1.1.0"
            ],
            "import_time": "2026-10-23T20:18:05.128132599Z",
            "modified_time": "2026-10-23T19:52:59Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 427018,
  "published_at": "2026-10-23T02:05:19+00:00"
}