MAL-2026-17641 Malicious code in troubleshooting (npm)

troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 7 versions, and 6 versions of browser-metrics-plugin.contrib with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC.

troubleshooting@2.0.1 is a stub package whose only functional behavior is a reconnaissance beacon. package.json declares scripts.postinstall: node beacon.cjs, which runs on npm install, and index.js runs the same beacon on require('troubleshooting') before exporting a Proxy whose properties all return no-ops so consuming bundlers do not crash. beacon.cjs collects the package name, os.hostname(), __dirname (install path), process.cwd(), and process.version, and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The README self-labels the package as an authorized dependency-confusion test, but the behavior is identical to a dependency-confusion exfiltration payload: any environment whose internal/private package name collides with troubleshooting on the public npm registry will have its build host, install path, working directory, and Node version reported to an outside party at a bare IP, providing actionable fingerprinting of internal build systems and CI runners.