cloudflare_module

Details

**Severity:** Critical

**Affected versions:** `= 3.0.0`

## Source: amazon-inspector (14316e66f8d8eeb53b5fd4850537ac5398947feaf88f3837e39bfa587f60a0fb)
[email protected] is a typosquat of Cloudflare branding whose only functional code is an install- and import-time beacon. beacon.cjs defines BEACON = "http://185.158.107.175:8787/_ah/dc" and a fire() function that POSTs a JSON payload containing os.hostname(), __dirname (installPath), process.cwd(), process.version and the package name to that hardcoded bare-IP HTTP endpoint. fire() is invoked from the package's postinstall script, so it runs automatically on `npm install`, and from the main module, so it also runs on `require('cloudflare_module')`. The package's main entry exports a Proxy of no-op functions (`module.exports = new Proxy({}, { get:... return _noop; })`) with a generic "Compatibility shim" description, so the package provides no legitimate functionality — the exfil beacon is its sole behavior. The destination is a bare IPv4 address on a non-standard port over cleartext HTTP, with no relationship to Cloudflare or any documented publisher. Host identity, install path and working directory shipped to an attacker-controlled collector constitute reconnaissance of installer environments suitable for targeted follow-on supply-chain exploitation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/cloudflare_module/MAL-2026-17768.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/cloudflare_module/MAL-2026-17768.json
- https://www.npmjs.com/package/cloudflare_module/v/1.0.0
- https://www.npmjs.com/package/cloudflare_module/v/1.0.1
- https://www.npmjs.com/package/cloudflare_module/v/3.0.0
- https://github.com/ossf/malicious-packages/blob/2bb9370d891283643f919e860abea2cc197b0b3b/osv/malicious/npm/cloudflare_module/MAL-2026-17768.json
- https://www.npmjs.com/package/cloudflare_module/v/99.0.1
- https://github.com/advisories/GHSA-9p5g-9jf3-6739

Compromised versions (1)

• = 3.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.