{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "@cecm-web-sdk/core"
   },
   "versions": [
    "3.0.0"
   ]
  }
 ],
 "aliases": [
  "MAL-2026-18213"
 ],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/@cecm-web-sdk/core/3.0.0"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "The package runs `node beacon.cjs` from its postinstall script, and its index.js runs the same beacon when the module is loaded. The script sends an HTTP POST to http://185.158.107.175:8787/_ah/dc with the package name, the host name, the installation directory, the current working directory and the Node.js version. It does nothing else. The package has no legitimate function: the name and high version numbers match a dependency-confusion attack that reports where an internal package name gets installed.\n\nImpact: whoever runs the receiving server learns which hosts and build systems install the package, and where.\n\nRemediation: remove the package from all projects and lockfiles, pin internal package names to your private registry scope, and review the hosts that installed it.",
 "id": "PROTET-NPM-2026-27",
 "modified": "2026-10-23T04:59:02Z",
 "published": "2026-10-22T10:49:06Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/@cecm-web-sdk/core/3.0.0"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Malicious code in @cecm-web-sdk/core (npm)"
}