Malicious code in @grabcad/company-server-shared (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (77669bd2c3c9138e7d3ab0612febc058dfd8235eb812a40ffb5bf3f27d19bf47) Package self-describes as a `Compatibility shim.` for the `@grabcad` scope and ships no real functionality: `index.js` exports a Proxy whose property access returns no-op functions, so a build importing the real `@grabcad/company-server-shared` resolves this placeholder and silently succeeds. On installation, the `postinstall` script runs `node beacon.cjs`, and `index.js` also invokes the same `fire()` routine on require. The beacon POSTs JSON containing `os.hostname()`, `__dirname` (install path), `process.cwd()`, and the Node/npm version to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The combination of a scoped placeholder with no legitimate functionality, automatic install-time and require-time execution, and a hardcoded recon callback to an unrelated bare IP is the standard shape of a dependency-confusion attack targeting the private `@grabcad` scope, leaking internal hostnames and build-path metadata to an attacker-controlled destination. ## Source: ghsa-malware (2d3297d13e6357ac5ba4aec72460852436e01486aeeffe04bf868aa8ccc58ceb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the comp
- Products
- @grabcad/company-server-shared
- Affected versions
- 0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1
- Fixed versions
- Not specified
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 10:35 UTC · Revision 1
Source evidence
Malicious code in @grabcad/company-server-shared (npm)
core-osv · Original sourcePublished 23 Oct 2026, 02:05 UTC
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (77669bd2c3c9138e7d3ab0612febc058dfd8235eb812a40ffb5bf3f27d19bf47) Package self-describes as a `Compatibility shim.` for the `@grabcad` scope and ships no real functionality: `index.js` exports a Proxy whose property access returns no-op functions, so a build importing the real `@grabcad/company-server-shared` resolves this placeholder and silently succeeds. On installation, the `postinstall` script runs `node beacon.cjs`, and `index.js` also invokes the same `fire()` routine on require. The beacon POSTs JSON containing `os.hostname()`, `__dirname` (install path), `process.cwd()`, and the Node/npm version to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The combination of a scoped placeholder with no legitimate functionality, automatic install-time and require-time execution, and a hardcoded recon callback to an unrelated bare IP is the standard shape of a dependency-confusion attack targeting the private `@grabcad` scope, leaking internal hostnames and build-path metadata to an attacker-controlled destination. ## Source: ghsa-malware (2d3297d13e6357ac5ba4aec72460852436e01486aeeffe04bf868aa8ccc58ceb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the comp
osv:MAL-2026-18214
@grabcad/company-server-shared
Fixed versions: Not specified
Complete source record
{
"id": "1854f4766a16061d8410b95dca13ccccf2de6dcfd24cb49ed63cea152a70fabc",
"url": "https://osv.dev/vulnerability/MAL-2026-18214",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Malicious code in @grabcad/company-server-shared (npm)",
"summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (77669bd2c3c9138e7d3ab0612febc058dfd8235eb812a40ffb5bf3f27d19bf47) Package self-describes as a `Compatibility shim.` for the `@grabcad` scope and ships no real functionality: `index.js` exports a Proxy whose property access returns no-op functions, so a build importing the real `@grabcad/company-server-shared` resolves this placeholder and silently succeeds. On installation, the `postinstall` script runs `node beacon.cjs`, and `index.js` also invokes the same `fire()` routine on require. The beacon POSTs JSON containing `os.hostname()`, `__dirname` (install path), `process.cwd()`, and the Node/npm version to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The combination of a scoped placeholder with no legitimate functionality, automatic install-time and require-time execution, and a hardcoded recon callback to an unrelated bare IP is the standard shape of a dependency-confusion attack targeting the private `@grabcad` scope, leaking internal hostnames and build-path metadata to an attacker-controlled destination. ## Source: ghsa-malware (2d3297d13e6357ac5ba4aec72460852436e01486aeeffe04bf868aa8ccc58ceb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the comp",
"evidence": "osv:MAL-2026-18214",
"products": [
{
"name": {
"value": "@grabcad/company-server-shared",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "1.1.0",
"evidence": "/affected/0/versions"
},
{
"value": "2.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "99.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "2.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "0.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.1",
"evidence": "/affected/0/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "MAL-2026-18214",
"aliases": [
"GHSA-fpfw-7wv8-x4mh",
"MAL-2026-18214"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@grabcad/company-server-shared",
"purl": "pkg:npm/%40grabcad/company-server-shared",
"ecosystem": "npm"
},
"versions": [
"1.0.0",
"1.1.0",
"2.0.1",
"99.0.1",
"3.0.0",
"2.0.0",
"0.0.1",
"1.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@grabcad/company-server-shared/MAL-2026-18214.json",
"indicators": {
"evidence_files": [
{
"path": "beacon.cjs",
"tlsh": "e13161efa8f0e008aaaa7098c54f1409f27af4068401ab50f95c82915f6257c33fa8dc",
"sha256": "332065261f393588e7675c6f995915ce194b5e0017c7d08a904f8c37f166daa7"
},
{
"path": "index.js",
"tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
"sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "73d8564c7f4c3e688772d32ddd50ba8f2c3dc789",
"sha512_sri": "sha512-z1H3rnalz5rXV0mec2oSD9OQXPgh/0yRvfJgCw71Y5lJnNmSYMEVVqitoTqeVL47JszKZp/dieFlzCsHY2xNew=="
},
"filename": "company-server-shared-1.0.0.tgz"
}
]
}
}
}
],
"modified": "2026-10-26T06:00:04.226957299Z",
"provider": "osv",
"references": [
"https://github.com/advisories/GHSA-fpfw-7wv8-x4mh",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/1.0.0",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/1.1.0",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/2.0.1",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/99.0.1",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/3.0.0",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/2.0.0",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/0.0.1",
"https://www.npmjs.com/package/@grabcad/company-server-shared/v/1.0.1"
],
"provider_metadata": {
"malicious-packages-origins": [
{
"id": "GHSA-fpfw-7wv8-x4mh",
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"sha256": "2d3297d13e6357ac5ba4aec72460852436e01486aeeffe04bf868aa8ccc58ceb",
"source": "ghsa-malware",
"import_time": "2026-10-23T02:36:25.376638573Z",
"modified_time": "2026-10-23T02:05:20Z"
},
{
"id": "IN-MAL-2026-021642",
"sha256": "77669bd2c3c9138e7d3ab0612febc058dfd8235eb812a40ffb5bf3f27d19bf47",
"source": "amazon-inspector",
"versions": [
"1.0.0"
],
"import_time": "2026-10-23T20:18:06.504299948Z",
"modified_time": "2026-10-23T19:55:48Z"
},
{
"id": "IN-MAL-2026-021636",
"sha256": "d02bc98d8d9ddc18c396a599f7d07743b4598a1b6d8666c3233ceb2002bc82b1",
"source": "amazon-inspector",
"versions": [
"1.1.0"
],
"import_time": "2026-10-23T20:18:06.091891642Z",
"modified_time": "2026-10-23T19:54:58Z"
},
{
"id": "IN-MAL-2026-021634",
"sha256": "fc88679ee78eb96ffb2d459e25db877505c21b25b32829a2b6c3521a5a02228b",
"source": "amazon-inspector",
"versions": [
"2.0.1"
],
"import_time": "2026-10-23T20:18:05.933545181Z",
"modified_time": "2026-10-23T19:54:42Z"
},
{
"id": "IN-MAL-2026-021638",
"sha256": "06f357c6ca258f72db79b0b5827e7b93d5a143ca6d9d96cc1135d29e3c33f7bf",
"source": "amazon-inspector",
"versions": [
"99.0.1"
],
"import_time": "2026-10-23T20:18:06.193395005Z",
"modified_time": "2026-10-23T19:55:11Z"
},
{
"id": "IN-MAL-2026-021635",
"sha256": "21b10b2173e5287c58c77527105ed69b4e5237fcabbac02dfef1157f8e8e404a",
"source": "amazon-inspector",
"versions": [
"3.0.0"
],
"import_time": "2026-10-23T20:18:06.010205347Z",
"modified_time": "2026-10-23T19:54:50Z"
},
{
"id": "IN-MAL-2026-021637",
"sha256": "2fbc9d0f29cbf1d05aef9766f3dd0cd9642960d64db6c1cf09e4b47ef7ca5081",
"source": "amazon-inspector",
"versions": [
"2.0.0"
],
"import_time": "2026-10-23T20:18:06.144832909Z",
"modified_time": "2026-10-23T19:55:04Z"
},
{
"id": "IN-MAL-2026-021643",
"sha256": "36024ea1024493f18cfe9e3a26814a3fe5037428d2389a48bf51d568510b84c2",
"source": "amazon-inspector",
"versions": [
"0.0.1"
],
"import_time": "2026-10-23T20:18:06.548746912Z",
"modified_time": "2026-10-23T19:55:55Z"
},
{
"id": "IN-MAL-2026-021715",
"sha256": "245399398154e04fd36ab726a3c4f1b0f1527a414a956c8dad55074c059d50cb",
"source": "amazon-inspector",
"versions": [
"1.0.1"
],
"import_time": "2026-10-26T05:46:51.981496447Z",
"modified_time": "2026-10-26T05:29:56Z"
}
]
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 446725,
"published_at": "2026-10-23T02:05:19+00:00"
}