{"items":[{"id":"NVI-00009638","kind":"supply_chain_event","title":"Malicious code in wie888r (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fhmp-x3hx-6669"],"plain_summary":"GitHub lists this malware advisory for wie888r, wie888r, wie888r, wie888r, wie888r. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-18bf9676ec1ca1082d20c924496f9368","url":"https://github.com/advisories/GHSA-fhmp-x3hx-6669","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fhmp-x3hx-6669","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:01.069Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 1.0.0"]},{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 99.0.1"]},{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 1.1.0"]},{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 0.0.1"]},{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 2.0.0"]},{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 3.0.0"]},{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 2.0.1"]},{"certainty":"source_listed","source_ids":["sr-18bf9676ec1ca1082d20c924496f9368"],"technology":"wie888r","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b)\nwie888r@3.0.0 ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/198de23effaed79e1ee13","public_affected_ranges":["= 1.0.1"]}],"null_published_at":"2026-10-31T22:13:39.926Z","source_updated_at":"2026-10-09T00:31:01.000Z","source_disclosed_at":"2026-10-09T00:30:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:01.069Z"}],"next_cursor":null,"snapshot_revision":"42594"}