ecobee-api

{"modified":"2026-08-25T06:44:49Z","published":"2026-08-25T06:44:49Z","schema_version":"1.7.4","id":"MAL-2026-14474","summary":"Malicious code in ecobee-api (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f)\nOn `npm install`, ecobee-api runs `node beacon.js` via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint http://169.58.96.170:9001/cb, passing the installer's hostname (os.hostname()) and the package name as query parameters. The package ships no functional library code — package.json declares an UNLICENSED 'Utility package' with a name resembling the Ecobee vendor, and the only substantive shipped file is the beacon. This is the shape of a dependency-confusion / typosquat recon beacon: it confirms install-time code execution on the victim host and identifies the host to the operator of 169.58.96.170 over plain HTTP.\n","affected":[{"package":{"ecosystem":"npm","name":"ecobee-api"},"versions":["0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"c42cdebde43f0090d495ca54fb988ad0e55071b9529098a05347b0de515fa924","tlsh":"d7d023d651c4531854627111c57b0806e3d7d1122cd90e408c4042f25e7449629175f4"},{"path":"package.json","sha256":"1775b8a74946a7193d8d1c7558981aab17b0e2745bb4e8512d54eac437ae34d8","tlsh":"9fd0a944ca101e6724c5aed30c24688aa1382c8b21087d082aa3004c038c3ba18fb238"}],"package_integrity":[{"filename":"ecobee-api-0.0.2.tgz","hashes":{"sha1":"75fb75375d7ee94fe1f655b1a7f0d83a57c9c3fb","sha512_sri":"sha512-8YZqKAoi+UrGHVN0sTN9VFcRP3EQohFxmY4rM7Muaqr/9l57VbhmaibI5QsMAdoWuum8igANEC5mNzO9h9LC6A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecobee-api/v/0.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018688","import_time":"2026-08-25T06:50:12.665874582Z","modified_time":"2026-08-25T06:44:49Z","sha256":"bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f","source":"amazon-inspector","versions":["0.0.2"]}]}}