{"items":[{"id":"NVI-00009830","kind":"supply_chain_event","title":"Malicious code in ph-common (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g6x8-wj65-55v2"],"plain_summary":"GitHub lists this malware advisory for ph-common, ph-common, ph-common, ph-common, ph-common. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6d4cbb48a4c732ce8996f398e152b07b","url":"https://github.com/advisories/GHSA-g6x8-wj65-55v2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g6x8-wj65-55v2","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:22.853Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 77.7.7"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 1.1.0"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 0.1.0"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 1.0.0"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 99.0.1"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 2.0.1"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 1.0.1"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 3.0.0"]},{"certainty":"source_listed","source_ids":["sr-6d4cbb48a4c732ce8996f398e152b07b"],"technology":"ph-common","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)\nThe package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malici","public_affected_ranges":["= 2.0.0"]}],"null_published_at":"2026-10-31T22:13:39.949Z","source_updated_at":"2026-10-06T00:34:12.000Z","source_disclosed_at":"2026-10-05T06:30:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:22.853Z"}],"next_cursor":null,"snapshot_revision":"42594"}