Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in @wxwxtest/testrrrdd (npm)

Type: advisorySources: OSV

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34) The package ships a postinstall script (`scripts.postinstall` runs `node beacon.cjs`) and a top-level `require('./beacon.cjs').fire()` in `index.js` that POST installer host metadata — hostname, install path, cwd, Node version, and package name — to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The exfiltration fires automatically both on `npm install` and on any `require()` of the package. `index.js` otherwise exports a Proxy returning no-op functions for any property access, so the package has no legitimate functionality; its sole effect is the callback to the hardcoded endpoint. The destination is not associated with any publisher domain and is unrelated to the self-described 'compatibility shim' purpose. The shape (stub Proxy export + install/require-time beacon to a bare-IP collector) is a dependency-confusion / typosquat proof-of-installation beacon.

Products
@wxwxtest/testrrrdd
Affected versions
0.0.1, 0.1.0, 1.0.0, 1.0.1, 2.0.0, 2.0.1, 3.0.0
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
28 Oct 2026, 10:05 UTC · Revision 1

Source evidence

Malicious code in @wxwxtest/testrrrdd (npm)

core-osv · Original source

Published 8 Oct 2026, 21:21 UTC

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34) The package ships a postinstall script (`scripts.postinstall` runs `node beacon.cjs`) and a top-level `require('./beacon.cjs').fire()` in `index.js` that POST installer host metadata — hostname, install path, cwd, Node version, and package name — to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The exfiltration fires automatically both on `npm install` and on any `require()` of the package. `index.js` otherwise exports a Proxy returning no-op functions for any property access, so the package has no legitimate functionality; its sole effect is the callback to the hardcoded endpoint. The destination is not associated with any publisher domain and is unrelated to the self-described 'compatibility shim' purpose. The shape (stub Proxy export + install/require-time beacon to a bare-IP collector) is a dependency-confusion / typosquat proof-of-installation beacon.

osv:MAL-2026-17704

@wxwxtest/testrrrdd

Fixed versions: Not specified

Complete source record
{
  "id": "1b1da1f6401ce5892fdb16076447f26b1a6ea65af2b976f99039907efe0580e6",
  "url": "https://osv.dev/vulnerability/MAL-2026-17704",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @wxwxtest/testrrrdd (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34) The package ships a postinstall script (`scripts.postinstall` runs `node beacon.cjs`) and a top-level `require('./beacon.cjs').fire()` in `index.js` that POST installer host metadata — hostname, install path, cwd, Node version, and package name — to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The exfiltration fires automatically both on `npm install` and on any `require()` of the package. `index.js` otherwise exports a Proxy returning no-op functions for any property access, so the package has no legitimate functionality; its sole effect is the callback to the hardcoded endpoint. The destination is not associated with any publisher domain and is unrelated to the self-described 'compatibility shim' purpose. The shape (stub Proxy export + install/require-time beacon to a bare-IP collector) is a dependency-confusion / typosquat proof-of-installation beacon.",
    "evidence": "osv:MAL-2026-17704",
    "products": [
      {
        "name": {
          "value": "@wxwxtest/testrrrdd",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "3.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17704",
      "aliases": [
        "MAL-2026-17704"
      ],
      "affected": [
        {
          "package": {
            "name": "@wxwxtest/testrrrdd",
            "purl": "pkg:npm/%40wxwxtest/testrrrdd",
            "ecosystem": "npm"
          },
          "versions": [
            "2.0.1",
            "2.0.0",
            "0.0.1",
            "3.0.0",
            "0.1.0",
            "1.0.0",
            "1.0.1"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wxwxtest/testrrrdd/MAL-2026-17704.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "beacon.cjs",
                  "tlsh": "3f3161eba8f1a0489aa77098c54f0409f17bf0068401ab50f95c82955f6153c33fa8dc",
                  "sha256": "b90b0687de31609c4a0ed88db0d1979d33b510ec8e772abc2102b169766f09e7"
                },
                {
                  "path": "index.js",
                  "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
                  "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "f15a8241a11d830a39d4a0aa33a42d8a61d5a80c",
                    "sha512_sri": "sha512-oZCcmW2AH5v1a7iMachtLDnfIVWvO2xnVOibjbAuMDtV4BSo+jr3XyQW8moa1MyMWrxL8NWa3yJHB2J3RuUatA=="
                  },
                  "filename": "testrrrdd-2.0.1.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T21:45:48.342129953Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.1",
        "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/2.0.0",
        "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.0.1",
        "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/3.0.0",
        "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/0.1.0",
        "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.0",
        "https://www.npmjs.com/package/@wxwxtest/testrrrdd/v/1.0.1"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021268",
            "sha256": "093f62f129fa3bb6fb05829e930449393d54a9d5e72a5188aaa542a26b0ce368",
            "source": "amazon-inspector",
            "versions": [
              "2.0.1"
            ],
            "import_time": "2026-10-08T21:42:57.762614731Z",
            "modified_time": "2026-10-08T21:23:51Z"
          },
          {
            "id": "IN-MAL-2026-021252",
            "sha256": "4a04b2b4f02f5d06a3729f210aa1ec9844c54ad8b1653677fc6e3d62e7f18549",
            "source": "amazon-inspector",
            "versions": [
              "2.0.0"
            ],
            "import_time": "2026-10-08T21:42:56.519207066Z",
            "modified_time": "2026-10-08T21:21:34Z"
          },
          {
            "id": "IN-MAL-2026-021253",
            "sha256": "73ce932992891761028144293d7b2e414208fee2695adccf3d09bbd8751f3f79",
            "source": "amazon-inspector",
            "versions": [
              "0.0.1"
            ],
            "import_time": "2026-10-08T21:42:56.623622268Z",
            "modified_time": "2026-10-08T21:21:42Z"
          },
          {
            "id": "IN-MAL-2026-021255",
            "sha256": "e194808ec33e50a585181e38b0359bd1f04e848fd87aa06c6bca80bbde2a50a7",
            "source": "amazon-inspector",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-10-08T21:42:56.780389011Z",
            "modified_time": "2026-10-08T21:22:00Z"
          },
          {
            "id": "IN-MAL-2026-021251",
            "sha256": "e7fce4d8536bf6254aa0791b2d048874ea7cc153303b68e28aa7e296493b342e",
            "source": "amazon-inspector",
            "versions": [
              "0.1.0"
            ],
            "import_time": "2026-10-08T21:42:56.457783297Z",
            "modified_time": "2026-10-08T21:21:26Z"
          },
          {
            "id": "IN-MAL-2026-021269",
            "sha256": "0e87a3919d1aeb1d6b9f3069d72f5098fe92fbafc821448753dc650745ff0f62",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-08T21:42:57.845095126Z",
            "modified_time": "2026-10-08T21:23:58Z"
          },
          {
            "id": "IN-MAL-2026-021250",
            "sha256": "2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34",
            "source": "amazon-inspector",
            "versions": [
              "1.0.1"
            ],
            "import_time": "2026-10-08T21:42:56.358827821Z",
            "modified_time": "2026-10-08T21:21:17Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 104698,
  "published_at": "2026-10-08T21:21:17+00:00"
}