wie888r

{"modified":"2026-10-08T21:44:50Z","published":"2026-10-08T21:20:37Z","schema_version":"1.7.4","id":"MAL-2026-17707","summary":"Malicious code in wie888r (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n","affected":[{"package":{"ecosystem":"npm","name":"wie888r"},"versions":["1.0.0","99.0.1","1.1.0","0.0.1","2.0.0","3.0.0","2.0.1","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"74486ba8bcbf05398d39cc7247ed13bbea7b7b8d622a429c2aeff3ca47155e90","tlsh":"0e314feba8e1e048aaab7098c54f5409b27af4069501ab50f95c82959f6193c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}],"package_integrity":[{"filename":"wie888r-1.0.0.tgz","hashes":{"sha1":"8430317c746cd5520f92c9ca8868b5a95c63f31d","sha512_sri":"sha512-KrB74yy7HeetOwIxmlcx8m440b6eD96zFe0hGGWfZuuB4Ry5UbjFeEkESMDmjrFx75slvqc51Q1c/n1InW6n3g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/wie888r/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021248","import_time":"2026-10-08T21:42:56.144006922Z","modified_time":"2026-10-08T21:21:00Z","sha256":"3823186f8957f645e69918ddc119533525da2b2f4ade832708fca49c82c29497","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-021247","import_time":"2026-10-08T21:42:56.076027669Z","modified_time":"2026-10-08T21:20:52Z","sha256":"5401e3ae6994379bc03f2809d38fad3cec63a634eab8b75fd7446f938eb094df","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-021273","import_time":"2026-10-08T21:42:58.214301359Z","modified_time":"2026-10-08T21:24:38Z","sha256":"a6e03f401cb7067aa5565739be4e4f29961a095d364456f12d109b5ff7eae540","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-021270","import_time":"2026-10-08T21:42:57.948073518Z","modified_time":"2026-10-08T21:24:09Z","sha256":"a8516d676e7d910b74f4b127bc8162ea7cba5c99fff27664f3e5197404cbb48f","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-021245","import_time":"2026-10-08T21:42:55.934466821Z","modified_time":"2026-10-08T21:20:37Z","sha256":"b3218be052a102c6c6af5658d2cc3dee7de5032344de96c25c4e2ce3d4c6b4b2","source":"amazon-inspector","versions":["2.0.0"]},{"id":"IN-MAL-2026-021254","import_time":"2026-10-08T21:42:56.701264243Z","modified_time":"2026-10-08T21:21:49Z","sha256":"b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b","source":"amazon-inspector","versions":["3.0.0"]},{"id":"IN-MAL-2026-021246","import_time":"2026-10-08T21:42:56.010296378Z","modified_time":"2026-10-08T21:20:45Z","sha256":"b9f4b05c5866a2cd6c1410b5a54841b79ed5f1a82f3999343c09f28c96c1dbb6","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-021249","import_time":"2026-10-08T21:42:56.274727488Z","modified_time":"2026-10-08T21:21:08Z","sha256":"fd610acdcc0707d12db8a2603b1e96c76d27f4888f7a999f7ce6181b3dce5515","source":"amazon-inspector","versions":["1.0.1"]}]}}