Malicious code in nitro-cjs-requirer (npm)

The nitro-cjs-requirer package is a malicious npm module that includes a postinstall script and runtime code which send identifying information such as package name, hostname, installation path, current working directory, and Node.js version to a hardcoded bare-IP HTTP endpoint (http://185.158.107.175:8787/_ah/dc). This occurs unconditionally both at npm install time and when the module is loaded via require(), effectively acting as a beacon for dependency confusion or build pipeline reconnaissance. The module exports a Proxy object that returns no-op functions, masking its malicious intent.

The package leaks sensitive environment and host information to an external attacker-controlled server without user knowledge or consent. This information could be used for further targeted attacks, reconnaissance, or supply chain compromise. There is no indication of direct code execution or system compromise beyond data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing or using the nitro-cjs-requirer package, especially versions =0.0.1, =1.0.0, =1.1.0, =2.0.0, =3.0.0, and =99.0.1. Review dependencies for this package and remove or replace it if found. Monitor for suspicious network connections to the indicated IP address and consider blocking outbound HTTP traffic to untrusted IPs. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.