nitro-bundled-dep

{"schema_version":"1.7.4","id":"MAL-2026-17774","published":"2026-10-11T13:50:38Z","modified":"2026-10-12T14:28:21.873196768Z","summary":"Malicious code in nitro-bundled-dep (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622)\nThe npm package nitro-bundled-dep@0.0.1 presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname, install path, current working directory, and Node version — to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The beacon in beacon.cjs is invoked from package.json's postinstall script, so it fires automatically on `npm install`, and is also invoked from index.js so it fires again whenever the module is required. The main module exports a Proxy that returns no-op functions for any property access, allowing a victim build that imports this name to continue without errors after the beacon has executed — the shape of a dependency-confusion / name-squat payload whose purpose is to confirm successful code execution inside a target build environment and report host identifiers to an attacker-controlled collector.\n","affected":[{"package":{"name":"nitro-bundled-dep","ecosystem":"npm"},"versions":["99.0.1","2.0.1","1.1.0","0.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"714abd13896833fdc6225b6cf615e48f4372fa51e5843cd3190a82b74ecfcce0","tlsh":"9d3161eba8f1a0489aaa7098c54f0409b17bf0078401af50fd6c83919f6193c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}],"package_integrity":[{"filename":"nitro-bundled-dep-99.0.1.tgz","hashes":{"sha1":"b9251a9e983d4dbfc3b82d85a6745dc00cd4e98b","sha512_sri":"sha512-/rMcdKmg0buD3+b8YiOufdpoPIR/8L2PD/+8/5v7dK7RSVn3yhHIBeuUtpue2uw12T/JsLQK+r6/wRkCV7tryA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nitro-bundled-dep/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021380","import_time":"2026-10-11T14:18:00.905141556Z","modified_time":"2026-10-11T13:50:38Z","sha256":"0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-021400","import_time":"2026-10-11T14:18:02.511535763Z","modified_time":"2026-10-11T13:53:42Z","sha256":"43f38c7ac6c0c53ea6787893d1a02c96e0a328e447c151104791f5b1ec4be0a3","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-021389","import_time":"2026-10-11T14:18:01.639057095Z","modified_time":"2026-10-11T13:52:07Z","sha256":"7291ba5dfedba6c562a9cf2641f3ec3f489d8d05721836f4fb2a1674ef4e808a","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-021462","import_time":"2026-10-12T14:26:36.174873037Z","modified_time":"2026-10-12T14:22:58Z","sha256":"893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-021461","import_time":"2026-10-12T14:26:35.995050146Z","modified_time":"2026-10-12T14:22:47Z","sha256":"ebf09359ca313a9c519ccfce35a0abe94dc2c84ceadb367388c76415bd64cf60","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}