{"answers":{"affected":"1 open source package ship an affected version, including nested-lib.","exploited":"There is no known exploitation of MAL-2026-17773 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17773 is a malicious package in nested-lib, published on 11 Oct 2026."},"fix_prompt":"MAL-2026-17773 is a malicious package: nested-lib (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17773/ (Markdown: https://insights.sbomify.com/MAL-2026-17773/index.md)","id":"MAL-2026-17773","markdown":"https://insights.sbomify.com/MAL-2026-17773/index.md","name":"MAL-2026-17773","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package declares `scripts.postinstall = \"node beacon.cjs\"` and `index.js` also invokes `require('./beacon.cjs').fire()` at module load. `beacon.cjs` POSTs a JSON payload containing `os.hostname()`, `__dirname`, `process.cwd()`, and `process.version` over plain HTTP to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The destination is not a documented first-party service and the host identifiers are sent without any opt-in. `index.js` otherwise exports a Proxy that returns no-op functions for every property access, so the package provides no real functionality — its sole on-install and on-require effect is the beacon. The combination of a hollow Proxy shim, a bare-IP plain-HTTP destination, and automatic firing from both the npm lifecycle hook and the main module is consistent with a reconnaissance/confirmation beacon used to validate successful installation into target environments, typically preceding a second-stage payload.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in nested-lib (npm)","id":"MAL-2026-17773","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"nested-lib","purl":"pkg:npm/nested-lib","source":"MAL-2026-17773"}],"products":null,"published":"2026-10-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17773/"}