Malicious code in cloudflare_module (npm)

The 'cloudflare_module' npm package (version 99.0.1) is a malicious package designed as a dependency-confusion lure targeting the 'cloudflare_*' namespace. It declares a postinstall script that runs 'beacon.cjs', which sends a JSON payload containing the host's name, installation path, current working directory, and Node.js version to a hardcoded bare-IP endpoint over plain HTTP. Additionally, the main module requires and fires the beacon on import, ensuring data exfiltration during runtime. The package exports a Proxy object that returns no-op functions to avoid errors during bundling, facilitating silent execution of the beacon. The package's README claims it is an 'authorized dependency-confusion test,' but the exfiltration occurs without user consent and targets any system resolving the package name, with the destination being an unattributed IP address unrelated to Cloudflare infrastructure.

Systems that install or import the 'cloudflare_module' package version 99.0.1 may unknowingly send identifying system information to an attacker-controlled server. This data includes hostname, installation directory, current working directory, and Node.js version. The exfiltration occurs without user consent and over unencrypted HTTP, exposing sensitive environment details that could aid further attacks or reconnaissance. The package's design avoids detection by bundlers and does not produce errors, increasing the likelihood of unnoticed compromise.

No official patch or remediation is indicated in the provided data. Users should avoid installing or using the 'cloudflare_module' package, especially version 99.0.1 and other listed versions. Verify package authenticity before installation, prefer official sources, and audit dependencies for suspicious behavior. Since this is a malicious package published to npm, removing it from projects and replacing it with legitimate dependencies is recommended. Monitor for any unexpected network connections to suspicious IP addresses such as 185.158.107.175. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.