Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in nitro-cjs-requirer (npm)

Type: advisorySources: OSV

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b) The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape — hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers — is a dependency-confusion or build-pipeline reconnaissance probe.

Products
nitro-cjs-requirer
Affected versions
0.0.1, 1.0.0, 1.1.0, 2.0.0, 3.0.0, 99.0.1
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 01:56 UTC · Revision 1

Source evidence

Malicious code in nitro-cjs-requirer (npm)

core-osv · Original source

Published 11 Oct 2026, 13:51 UTC

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b) The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape — hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers — is a dependency-confusion or build-pipeline reconnaissance probe.

osv:MAL-2026-17775

nitro-cjs-requirer

Fixed versions: Not specified

Complete source record
{
  "id": "468a6e46626ef43325da73530b59ab6700e572c4674fb0f6392913ed4f3173b6",
  "url": "https://osv.dev/vulnerability/MAL-2026-17775",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in nitro-cjs-requirer (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b) The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape — hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers — is a dependency-confusion or build-pipeline reconnaissance probe.",
    "evidence": "osv:MAL-2026-17775",
    "products": [
      {
        "name": {
          "value": "nitro-cjs-requirer",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "99.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "3.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17775",
      "aliases": [
        "MAL-2026-17775"
      ],
      "affected": [
        {
          "package": {
            "name": "nitro-cjs-requirer",
            "purl": "pkg:npm/nitro-cjs-requirer",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0",
            "0.0.1",
            "1.1.0",
            "2.0.0",
            "99.0.1",
            "3.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nitro-cjs-requirer/MAL-2026-17775.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "beacon.cjs",
                  "tlsh": "ac3161eba8e0a008aaa67098c54f0409b17bf0078501af50fd5c82919f6153c33fa8dc",
                  "sha256": "d3070b8fef42de65aef2a9ffe3b22d6c904520ded44be82ccd538fa7f507ec6c"
                },
                {
                  "path": "index.js",
                  "tlsh": "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee",
                  "sha256": "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "eeb3328db97869bb6fcab89219ad4904a0b9a856",
                    "sha512_sri": "sha512-nsakMiZ8uWjjxWcvNwXJEnbBtxRE8im4IDYK4x2lzi2sDxsZMLn5DSk/ivAF0midPbj8XpR8YX+s6LcLZHNs2Q=="
                  },
                  "filename": "nitro-cjs-requirer-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-11T14:30:08.414391755Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/nitro-cjs-requirer/v/1.0.0",
        "https://www.npmjs.com/package/nitro-cjs-requirer/v/0.0.1",
        "https://www.npmjs.com/package/nitro-cjs-requirer/v/1.1.0",
        "https://www.npmjs.com/package/nitro-cjs-requirer/v/2.0.0",
        "https://www.npmjs.com/package/nitro-cjs-requirer/v/99.0.1",
        "https://www.npmjs.com/package/nitro-cjs-requirer/v/3.0.0"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021409",
            "sha256": "1cddd06b2ec2f8f432460f051b96f64db2fd2eb3a5cca5966ce9987d93b84052",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-11T14:18:03.234826964Z",
            "modified_time": "2026-10-11T13:55:05Z"
          },
          {
            "id": "IN-MAL-2026-021440",
            "sha256": "b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b",
            "source": "amazon-inspector",
            "versions": [
              "0.0.1"
            ],
            "import_time": "2026-10-11T14:18:06.186319166Z",
            "modified_time": "2026-10-11T14:00:00Z"
          },
          {
            "id": "IN-MAL-2026-021406",
            "sha256": "d3e330b9ba4b12d56187afb801280b4f629ecc2d8a6caa11ef8f19d39c5faff5",
            "source": "amazon-inspector",
            "versions": [
              "1.1.0"
            ],
            "import_time": "2026-10-11T14:18:02.96104776Z",
            "modified_time": "2026-10-11T13:54:35Z"
          },
          {
            "id": "IN-MAL-2026-021405",
            "sha256": "e1aaec8fedc0d25e84befb8dc069e8ec1869376b50c9500ee0194fead42426f5",
            "source": "amazon-inspector",
            "versions": [
              "2.0.0"
            ],
            "import_time": "2026-10-11T14:18:02.893388264Z",
            "modified_time": "2026-10-11T13:54:26Z"
          },
          {
            "id": "IN-MAL-2026-021383",
            "sha256": "f420c7a515f174ae453ff2bcfc84a554602d363bfd77aa4744f17deb6357ea11",
            "source": "amazon-inspector",
            "versions": [
              "99.0.1"
            ],
            "import_time": "2026-10-11T14:18:01.136249744Z",
            "modified_time": "2026-10-11T13:51:12Z"
          },
          {
            "id": "IN-MAL-2026-021436",
            "sha256": "abf51a98bdcb0068cdfe0026958859bc27434945ffc1db815bd44bded7dfe114",
            "source": "amazon-inspector",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-10-11T14:18:05.791497694Z",
            "modified_time": "2026-10-11T13:59:21Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 286046,
  "published_at": "2026-10-11T13:51:12+00:00"
}