troubleshooting

GHSA-42gg-4m94-8m7w

Malicious code in troubleshooting (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 7 versions, and 6 versions of browser-metrics-plugin.contrib with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/217dd0ab0154653b12db6468c1125d7b43fd9a0d/osv/malicious/npm/troubleshooting/MAL-2026-17641.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/217dd0ab0154653b12db6468c1125d7b43fd9a0d/osv/malicious/npm/troubleshooting/MAL-2026-17641.json
- https://www.npmjs.com/package/troubleshooting
- https://github.com/ossf/malicious-packages/blob/1f0efa038b4952b6f39151f24f216b7f464d67c4/osv/malicious/npm/troubleshooting/MAL-2026-17641.json
- https://www.npmjs.com/package/troubleshooting/v/0.1.0
- https://www.npmjs.com/package/troubleshooting/v/1.0.0
- https://www.npmjs.com/package/troubleshooting/v/1.0.1
- https://www.npmjs.com/package/troubleshooting/v/1.1.0
- https://www.npmjs.com/package/troubleshooting/v/2.0.1

Compromised versions (1)

= 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.