Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in wie888r (npm)

Type: advisorySources: OSV

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b) wie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.

Products
wie888r
Affected versions
0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
28 Oct 2026, 10:06 UTC · Revision 1

Source evidence

Malicious code in wie888r (npm)

core-osv · Original source

Published 8 Oct 2026, 21:20 UTC

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b) wie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.

osv:MAL-2026-17707

wie888r

Fixed versions: Not specified

Complete source record
{
  "id": "00e3eaa1f75c27f71fea7d44868b80d34875205db008a1734c32ac886ebd6607",
  "url": "https://osv.dev/vulnerability/MAL-2026-17707",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in wie888r (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b) wie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.",
    "evidence": "osv:MAL-2026-17707",
    "products": [
      {
        "name": {
          "value": "wie888r",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "99.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "3.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17707",
      "aliases": [
        "MAL-2026-17707"
      ],
      "affected": [
        {
          "package": {
            "name": "wie888r",
            "purl": "pkg:npm/wie888r",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0",
            "99.0.1",
            "1.1.0",
            "0.0.1",
            "2.0.0",
            "3.0.0",
            "2.0.1",
            "1.0.1"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wie888r/MAL-2026-17707.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "beacon.cjs",
                  "tlsh": "0e314feba8e1e048aaab7098c54f5409b27af4069501ab50f95c82959f6193c33fa8dc",
                  "sha256": "74486ba8bcbf05398d39cc7247ed13bbea7b7b8d622a429c2aeff3ca47155e90"
                },
                {
                  "path": "index.js",
                  "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
                  "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "8430317c746cd5520f92c9ca8868b5a95c63f31d",
                    "sha512_sri": "sha512-KrB74yy7HeetOwIxmlcx8m440b6eD96zFe0hGGWfZuuB4Ry5UbjFeEkESMDmjrFx75slvqc51Q1c/n1InW6n3g=="
                  },
                  "filename": "wie888r-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T21:45:54.263791864Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/wie888r/v/1.0.0",
        "https://www.npmjs.com/package/wie888r/v/99.0.1",
        "https://www.npmjs.com/package/wie888r/v/1.1.0",
        "https://www.npmjs.com/package/wie888r/v/0.0.1",
        "https://www.npmjs.com/package/wie888r/v/2.0.0",
        "https://www.npmjs.com/package/wie888r/v/3.0.0",
        "https://www.npmjs.com/package/wie888r/v/2.0.1",
        "https://www.npmjs.com/package/wie888r/v/1.0.1"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021248",
            "sha256": "3823186f8957f645e69918ddc119533525da2b2f4ade832708fca49c82c29497",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-08T21:42:56.144006922Z",
            "modified_time": "2026-10-08T21:21:00Z"
          },
          {
            "id": "IN-MAL-2026-021247",
            "sha256": "5401e3ae6994379bc03f2809d38fad3cec63a634eab8b75fd7446f938eb094df",
            "source": "amazon-inspector",
            "versions": [
              "99.0.1"
            ],
            "import_time": "2026-10-08T21:42:56.076027669Z",
            "modified_time": "2026-10-08T21:20:52Z"
          },
          {
            "id": "IN-MAL-2026-021273",
            "sha256": "a6e03f401cb7067aa5565739be4e4f29961a095d364456f12d109b5ff7eae540",
            "source": "amazon-inspector",
            "versions": [
              "1.1.0"
            ],
            "import_time": "2026-10-08T21:42:58.214301359Z",
            "modified_time": "2026-10-08T21:24:38Z"
          },
          {
            "id": "IN-MAL-2026-021270",
            "sha256": "a8516d676e7d910b74f4b127bc8162ea7cba5c99fff27664f3e5197404cbb48f",
            "source": "amazon-inspector",
            "versions": [
              "0.0.1"
            ],
            "import_time": "2026-10-08T21:42:57.948073518Z",
            "modified_time": "2026-10-08T21:24:09Z"
          },
          {
            "id": "IN-MAL-2026-021245",
            "sha256": "b3218be052a102c6c6af5658d2cc3dee7de5032344de96c25c4e2ce3d4c6b4b2",
            "source": "amazon-inspector",
            "versions": [
              "2.0.0"
            ],
            "import_time": "2026-10-08T21:42:55.934466821Z",
            "modified_time": "2026-10-08T21:20:37Z"
          },
          {
            "id": "IN-MAL-2026-021254",
            "sha256": "b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b",
            "source": "amazon-inspector",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-10-08T21:42:56.701264243Z",
            "modified_time": "2026-10-08T21:21:49Z"
          },
          {
            "id": "IN-MAL-2026-021246",
            "sha256": "b9f4b05c5866a2cd6c1410b5a54841b79ed5f1a82f3999343c09f28c96c1dbb6",
            "source": "amazon-inspector",
            "versions": [
              "2.0.1"
            ],
            "import_time": "2026-10-08T21:42:56.010296378Z",
            "modified_time": "2026-10-08T21:20:45Z"
          },
          {
            "id": "IN-MAL-2026-021249",
            "sha256": "fd610acdcc0707d12db8a2603b1e96c76d27f4888f7a999f7ce6181b3dce5515",
            "source": "amazon-inspector",
            "versions": [
              "1.0.1"
            ],
            "import_time": "2026-10-08T21:42:56.274727488Z",
            "modified_time": "2026-10-08T21:21:08Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 104761,
  "published_at": "2026-10-08T21:20:37+00:00"
}