file-saver-bg 9.9.9

confirmed malicious PROTET-NPM-2026-167

Every version of this package that Protet Intel names: Is file-saver-bg malicious?

Details

A dependency-confusion package published 2026-11-07 under the name file-saver-bg with the inflated version 9.9.9 to win resolution over a private package. Both its preinstall and postinstall hooks run 'node beacon.js', which sends the machine's hostname, user name, current working directory and platform as query parameters of a cleartext HTTP GET to the hardcoded endpoint http://100.24.177.136/cb. Self-described as an authorized dependency-confusion proof of concept. Remove the package and treat the hostnames, user names and paths of affected build machines as disclosed.

Records

OSV record PROTET-NPM-2026-167
Also reported in OSV as MAL-2026-18797
Feeds: NDJSON, Atom

Status history

2026-11-07: named as a Protet finding
2026-11-10: active

Want to know if your own builds pull packages like this? Add the Protet GitHub Action.

Think this is wrong? Write to hello@protet.io and we will look at it.