Malicious code in some-very-long-package-name (npm)

The package 'some-very-long-package-name' exports a Proxy that returns no operational functionality, acting as a stub. Its main malicious behavior is implemented in beacon.cjs, which collects environment details such as hostname, install path, current working directory, Node.js version, package name, and user-agent. This information is sent via HTTP POST to a hardcoded bare-IP endpoint (http://185.158.107.175:8787/_ah/dc). The beacon triggers automatically during the post-install script and again when the module is required. This pattern aligns with reconnaissance beacons used in dependency confusion or internal name squatting attacks to confirm successful installation in private build environments.

The malicious package leaks sensitive environment information to an external attacker-controlled server. This can expose internal hostnames, installation paths, and runtime environment details, potentially aiding further targeted attacks or lateral movement within private build or deployment environments.

No official patch or remediation is currently documented. Users should avoid installing or requiring this package. Review dependency trees for unexpected or suspicious packages, especially those with unusual or overly long names. Consider using package allowlists and verifying package provenance to prevent dependency confusion or name squatting attacks.