ecobee2

{"modified":"2026-08-25T06:45:06Z","published":"2026-08-25T06:45:06Z","schema_version":"1.7.4","id":"MAL-2026-14476","summary":"Malicious code in ecobee2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba)\npackage.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to http://169.58.96.170:9001/cb with the installer's os.hostname() and the package name in the query string, disclosing host identity to a hardcoded bare-IP endpoint over cleartext HTTP at install time. The package README is a placeholder and no legitimate purpose is documented for this network activity.\n","affected":[{"package":{"ecosystem":"npm","name":"ecobee2"},"versions":["0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"94950b6d656cc60af1632c8741fdf355a5a6d3aa75d9241e5f5ba2fa176e6272","tlsh":"2cd023d651c4531454627110c57b0806e2d7d11228d90d404c4042f21f7445716179f4"},{"path":"package.json","sha256":"2d1b385436ad70bfc7a8bb0f2a1da08cd20647309013d4061b3e748edf120302","tlsh":"dcd02244ce002e7320c5aed30c34688aa0382c8b21083c0837e7004c038c3ba08ff23c"}],"package_integrity":[{"filename":"ecobee2-0.0.2.tgz","hashes":{"sha1":"53af5d1ec9ed384c2f03dbb829ec6c01ecfc2faf","sha512_sri":"sha512-DoMXiUqcRmcwaDOxVoJ1iEpSHIuhlmiwnNJwwpPHiDxnxaBvHVQGb0Pmf/oTL7bl8uZrPYb2pUcK7hXPsWOh4g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecobee2/v/0.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018690","import_time":"2026-08-25T06:50:12.760854759Z","modified_time":"2026-08-25T06:45:06Z","sha256":"42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba","source":"amazon-inspector","versions":["0.0.2"]}]}}