Malicious code in another-very-long-name (npm)

The 'another-very-long-name' npm package in versions 1.0.1, 1.1.0, 2.0.0, and 2.0.1 includes a beacon.cjs script executed during postinstall and module require time. This script collects host identifiers such as hostname, installation path, current working directory, Node.js version, OS metadata, and the package name, then sends this data as JSON to a hardcoded cleartext HTTP endpoint at 185.158.107.175:8787. The package's main module exports a Proxy object that returns no-op functions to avoid bundler errors, indicating the package's primary purpose is data collection rather than functionality. The external endpoint has no known relationship to the package publisher, and the behavior aligns with reconnaissance activity consistent with dependency confusion attack probes.

The malicious package can exfiltrate sensitive host environment information without user consent, potentially aiding attackers in mapping victim environments for further exploitation. The use of an unencrypted HTTP endpoint exposes the data to interception. There is no indication of direct code execution beyond data collection, and no known active exploitation in the wild has been reported.

No official patch or remediation guidance is provided. Users should avoid installing or using the affected versions (=1.0.1, =1.1.0, =2.0.0, =2.0.1) of the 'another-very-long-name' package. Review and remove the package from projects if present. Consider using trusted package sources and verifying package integrity before installation.