Malicious code in nested-lib (npm)

The nested-lib npm package versions 1.0.0, 1.0.1, and 1.1.0 include a postinstall script and runtime code that automatically send a JSON payload containing system identifiers (os.hostname(), __dirname, process.cwd(), process.version) to a hardcoded bare-IP HTTP endpoint (http://185.158.107.175:8787/_ah/dc). The package exports a Proxy object that returns no-op functions, providing no legitimate functionality. This behavior is consistent with a reconnaissance beacon used to validate installation in target environments, likely as a precursor to a second-stage payload. There is no indication of an official patch or remediation available.

The malicious code leaks sensitive environment information to an unauthorized external server without user consent, potentially exposing system details that could aid attackers in further exploitation. The package does not provide legitimate functionality, indicating its sole purpose is reconnaissance. No known exploits in the wild have been reported. The data is sent over unencrypted HTTP, increasing the risk of interception.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing or using the affected nested-lib package versions 1.0.0, 1.0.1, and 1.1.0. Consider removing the package from existing environments and monitor for updates from trusted sources regarding remediation.