ecobee-home

{"modified":"2026-08-25T06:45:38Z","published":"2026-08-25T06:45:38Z","schema_version":"1.7.4","id":"MAL-2026-14475","summary":"Malicious code in ecobee-home (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425)\nThe package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint (http://169.58.96.170:9001/cb) carrying the installer's hostname and the package name as query parameters. This fires automatically on npm install with no user opt-in. Reaching out to a bare-IP over plain HTTP with the installer's hostname on install is host-identifier reconnaissance/exfiltration to an attacker-controlled endpoint; the placeholder README and lookalike package name are consistent with a dependency-confusion / recon beacon rather than legitimate telemetry.\n","affected":[{"package":{"ecosystem":"npm","name":"ecobee-home"},"versions":["0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"73836d315574263f89a5285ed38ebdd2c81a1028be3d167596b4704665be0902","tlsh":"3fd023db52c4531854677110c57f0806e2d7d11129d90d404c4046f21e7455615175f4"}],"package_integrity":[{"filename":"ecobee-home-0.0.2.tgz","hashes":{"sha1":"5481e790e0d8bc9a4abc26b3112de91461936f13","sha512_sri":"sha512-fokKFE3XxkJ2T7XXdAraOGNJnRFxk5hFGR7at7Er6DUOmHznYgnjelEKfTt+WDb5TZgN85AQLqC9kVhCJ4perg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecobee-home/v/0.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018693","import_time":"2026-08-25T06:50:12.902628692Z","modified_time":"2026-08-25T06:45:38Z","sha256":"9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425","source":"amazon-inspector","versions":["0.0.2"]}]}}