registry / troubleshooting / 1.0.0

troubleshooting@1.0.0

OSV Malicious Advisory

imported 1d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17641 confirms this npm version as malicious. troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over...

Advisory

MAL-2026-17641

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in troubleshooting (npm)

Details

troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 7 versions, and 6 versions of browser-metrics-plugin.contrib with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC.

Decision reason

OpenSSF Malicious Packages via OSV confirms troubleshooting@1.0.0 as malicious (MAL-2026-17641): Malicious code in troubleshooting (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to troubleshooting@1.0.0.

The same advisory and Firewall decision cover 6 recorded versions

0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0

See version security history for other recorded verdicts.

Avoid installing troubleshooting@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-07 06:45:05.017Z (UTC).

Source advisory published: 2026-10-07 00:04:15.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.