@drone-js-ext/core

GHSA-68q8-r62c-rwgx

Malicious code in @drone-js-ext/core (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.1`

## Source: amazon-inspector (9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43)
The package ships a `beacon.cjs` that collects host identifiers (hostname, install path, current working directory, Node version) and POSTs them in cleartext to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. This beacon is wired to run automatically in two places: `package.json` declares `scripts.postinstall = "node beacon.cjs"`, so it executes on `npm install`, and `index.js` also invokes the same `fire()` function at module load, so it executes again on `require()`. The remainder of the package is a no-op Proxy shim with no functional code matching the stated `Compatibility shim` description. The scope-and-version shape (`@drone-js-ext/core` at version 99.0.1 against a plausibly internal `@drone-js-ext/*` namespace) matches a dependency-confusion lure designed to be resolved in place of a private internal package. A README self-label of `dependency-confusion test` does not change the behavior: any installer that resolves this package has host-identifying data sent to a non-vendor, non-registry, bare-IP, plaintext-HTTP collector controlled by a third party.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/@drone-js-ext/core/MAL-2026-18276.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/@drone-js-ext/core/MAL-2026-18276.json
- https://www.npmjs.com/package/@drone-js-ext/core/v/99.0.1
- https://github.com/ossf/malicious-packages/blob/38576efe4884e97a0598f23da7c6da0343b22df4/osv/malicious/npm/@drone-js-ext/core/MAL-2026-18276.json
- https://www.npmjs.com/package/@drone-js-ext/core
- https://github.com/ossf/malicious-packages/blob/4f27542fecd13e7f077489c04a2f3503d1189f32/osv/malicious/npm/@drone-js-ext/core/MAL-2026-18276.json
- https://www.npmjs.com/package/@drone-js-ext/core/v/1.0.0
- https://www.npmjs.com/package/@drone-js-ext/core/v/2.0.1
- https://www.npmjs.com/package/@drone-js-ext/core/v/3.0.0

Compromised versions (1)

= 99.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.