Malicious code in browser-metrics-plugin.contrib (npm)
browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 6 versions, and 7 versions of troubleshooting with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded) browser-metrics-plugin.contrib@1.0.1 ships beacon.cjs which POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and Node version to the hardcoded cleartext bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires twice: once from a postinstall lifecycle hook on npm install, and again at require time from index.js (the declared main), which calls require('./beacon.cjs').fire() at top level inside a try/catch. The module exports a Proxy of no-ops so that load failures do not break the surrounding build, concealing the beacon's presence. The se
- Products
- browser-metrics-plugin.contrib
- Affected versions
- 0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 99.0.1
- Fixed versions
- Not specified
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 08:58 UTC · Revision 1
Source evidence
Malicious code in browser-metrics-plugin.contrib (npm)
core-osv · Original sourcePublished 7 Oct 2026, 00:01 UTC
browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 6 versions, and 7 versions of troubleshooting with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded) browser-metrics-plugin.contrib@1.0.1 ships beacon.cjs which POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and Node version to the hardcoded cleartext bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires twice: once from a postinstall lifecycle hook on npm install, and again at require time from index.js (the declared main), which calls require('./beacon.cjs').fire() at top level inside a try/catch. The module exports a Proxy of no-ops so that load failures do not break the surrounding build, concealing the beacon's presence. The se
osv:MAL-2026-17640
browser-metrics-plugin.contrib
Fixed versions: Not specified
Complete source record
{
"id": "12e045ff7d7c9d8a170c08dfc35f1dd2ebe4a8a13bc887c5bd5a4e745ff58281",
"url": "https://osv.dev/vulnerability/MAL-2026-17640",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Malicious code in browser-metrics-plugin.contrib (npm)",
"summary": "browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a \"Compatibility shim\", uses version numbers up to 99.0.1, and its README calls it an \"authorized dependency-confusion test\". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 6 versions, and 7 versions of troubleshooting with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded) browser-metrics-plugin.contrib@1.0.1 ships beacon.cjs which POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and Node version to the hardcoded cleartext bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires twice: once from a postinstall lifecycle hook on npm install, and again at require time from index.js (the declared main), which calls require('./beacon.cjs').fire() at top level inside a try/catch. The module exports a Proxy of no-ops so that load failures do not break the surrounding build, concealing the beacon's presence. The se",
"evidence": "osv:MAL-2026-17640",
"products": [
{
"name": {
"value": "browser-metrics-plugin.contrib",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "1.1.0",
"evidence": "/affected/0/versions"
},
{
"value": "99.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "2.0.1",
"evidence": "/affected/0/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "MAL-2026-17640",
"aliases": [
"MAL-2026-17640"
],
"affected": [
{
"package": {
"name": "browser-metrics-plugin.contrib",
"purl": "pkg:npm/browser-metrics-plugin.contrib",
"ecosystem": "npm"
},
"versions": [
"0.0.1",
"1.0.0",
"1.1.0",
"99.0.1",
"1.0.1",
"2.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/browser-metrics-plugin.contrib/MAL-2026-17640.json",
"indicators": {
"evidence_files": [
{
"path": "beacon.cjs",
"tlsh": "883161eba8e4a0489eaa7098c54f0409b17bf4069401ab50fd5c82915f6197c33fa8dc",
"sha256": "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
},
{
"path": "README.md",
"tlsh": "8bd02b347424653054284bf648a1b06957fcd2bcc42645b9585e5e0c544a768532777a",
"sha256": "b4f5478f42b53a0b482c1cd846ed7ec27ae2cf57a6e738b415905c37ccbaae0e"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "6d8ca12624667ec5718440c6e8b1f97b7f98abdc",
"sha512_sri": "sha512-Rr9PzrM5ZkjOYl5enckeUJ5T3Vtm1R40kTTuhcVpYpMWejgCj3P3WGmDpxHEQvUE5//grsZc29A67BLdPVDL0g=="
},
"filename": "browser-metrics-plugin.contrib-99.0.1.tgz"
}
]
}
}
}
],
"modified": "2026-10-08T04:00:04.934314202Z",
"provider": "osv",
"references": [
"https://www.npmjs.com/package/browser-metrics-plugin.contrib",
"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/99.0.1",
"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/2.0.1",
"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/1.0.0",
"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/1.0.1",
"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/1.1.0",
"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/0.0.1"
],
"provider_metadata": {
"iocs": {
"ips": [
"185.158.107.175"
],
"urls": [
"http://185.158.107.175:8787/_ah/dc"
],
"files": [
{
"note": "Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions.",
"paths": [
"index.js"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@0.0.1).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "88be31855364b43e29af8f413bf77718668e433e9b99ecff86af611f691efbba"
}
},
{
"note": "Executed by the postinstall script of browser-metrics-plugin.contrib@0.0.1.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.0.0).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "f685ef1fd4bf7e6c89a1d30f9a95fb2565bf43aef8926c47831ea406ce6ec68f"
}
},
{
"note": "Executed by the postinstall script of browser-metrics-plugin.contrib@1.0.0.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.1.0).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "91930c57df71a1daf5175de4fc1321cd2141a74d5e65ba65bb27f29d3fda5d4c"
}
},
{
"note": "Executed by the postinstall script of browser-metrics-plugin.contrib@1.1.0.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@99.0.1).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "ee6d3b15a0f508112999466fd4eb170cb891850297f3bed92d3d657937886d4f"
}
},
{
"note": "Executed by the postinstall script of browser-metrics-plugin.contrib@99.0.1.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.0.1).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "24fddf171255e79f57cafdc4f3f98f3b4beb61fd5f655c2dd2ac7ba2a657a678"
}
},
{
"note": "Executed by the postinstall script of browser-metrics-plugin.contrib@1.0.1.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
}
},
{
"note": "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@2.0.1).",
"paths": [
"package.json"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "fd6ab85e9991034a33de280acf3acba5c15ea35210227017a764df9c420ff1e8"
}
},
{
"note": "Executed by the postinstall script of browser-metrics-plugin.contrib@2.0.1.",
"paths": [
"beacon.cjs"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"
}
}
]
},
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-021130",
"sha256": "5c14ea3f89a327e671b6bb6bfd27cb0db7fbc92f0777b89710442b792740d073",
"source": "amazon-inspector",
"versions": [
"99.0.1"
],
"import_time": "2026-10-08T03:50:29.902936689Z",
"modified_time": "2026-10-08T03:40:25Z"
},
{
"id": "IN-MAL-2026-021114",
"sha256": "8123f97c3618eb20a66da2dfb8a45256e76fb1c84c4a17ce844dac7a2389bfe6",
"source": "amazon-inspector",
"versions": [
"2.0.1"
],
"import_time": "2026-10-08T03:50:28.789336342Z",
"modified_time": "2026-10-08T03:38:02Z"
},
{
"id": "IN-MAL-2026-021107",
"sha256": "add156e4ab0c336588911b9741dc7b10a5b1471d4b094e2410c5325ceecb3401",
"source": "amazon-inspector",
"versions": [
"1.0.0"
],
"import_time": "2026-10-08T03:50:28.33757488Z",
"modified_time": "2026-10-08T03:36:55Z"
},
{
"id": "IN-MAL-2026-021108",
"sha256": "b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded",
"source": "amazon-inspector",
"versions": [
"1.0.1"
],
"import_time": "2026-10-08T03:50:28.395578472Z",
"modified_time": "2026-10-08T03:37:06Z"
},
{
"id": "IN-MAL-2026-021110",
"sha256": "ba360d12dd9384c50c52bb7367dcee82bc20aa303178b4782e9f2fb8b823f5c6",
"source": "amazon-inspector",
"versions": [
"1.1.0"
],
"import_time": "2026-10-08T03:50:28.532299242Z",
"modified_time": "2026-10-08T03:37:22Z"
},
{
"id": "IN-MAL-2026-021109",
"sha256": "d92366e7357cc9d42be3e33965b1c6bac85403f0b3f1fc079e33e81b81b61827",
"source": "amazon-inspector",
"versions": [
"0.0.1"
],
"import_time": "2026-10-08T03:50:28.455278516Z",
"modified_time": "2026-10-08T03:37:14Z"
}
]
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 98433,
"published_at": "2026-10-07T00:01:40+00:00"
}