Malicious code in nitro-bundled-dep (npm)

The nitro-bundled-dep package at version 99.0.1 includes a stub main module and a beacon script (beacon.cjs) that runs both during the postinstall lifecycle hook and on require() of the main module. The beacon collects environment details (os.hostname(), __dirname, process.cwd(), process.version) and sends them unencrypted to a hardcoded IP endpoint (http://185.158.107.175:8787/_ah/dc) that is not associated with any legitimate vendor. This setup matches a dependency confusion pattern, where an internal package name is hijacked on the public npm registry at an implausibly high version to execute reconnaissance on the host.

The malicious beacon leaks sensitive environment information to an unknown external server, potentially exposing internal hostnames, directory structures, and runtime environment details. This information could be used by attackers for further targeted attacks or reconnaissance. There is no indication of direct code execution beyond data exfiltration, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing or using the affected versions (=99.0.1, =2.0.1, =1.1.0) of nitro-bundled-dep. Verify dependencies carefully to prevent dependency confusion attacks, especially for internal package names that might be resolved to public registry packages with suspiciously high version numbers. Monitor package sources and consider using package integrity verification or private registries to mitigate risk.