ph-common

Details

**Severity:** Critical

**Affected versions:** `= 77.7.7`

## Source: amazon-inspector (f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2)
The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs, which POSTs the installer's hostname, install path (__dirname), cwd, and Node version as JSON to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the package.json postinstall lifecycle hook (`node beacon.cjs`) and at import time via a top-level `require('./beacon.cjs').fire()` in index.js. The destination is unrelated to any publisher infrastructure, uses a bare IP over cleartext HTTP, and the comments framing the payload as 'only machine/package metadata' do not change that unsolicited host identifiers are being sent off-host on install and on require. The stub-plus-beacon shape is consistent with a dependency-confusion or name-squat reconnaissance probe.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/ph-common/MAL-2026-1809.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/ph-common/MAL-2026-1809.json
- https://www.npmjs.com/package/ph-common/v/0.1.0
- https://www.npmjs.com/package/ph-common/v/1.0.0
- https://www.npmjs.com/package/ph-common/v/1.0.1
- https://www.npmjs.com/package/ph-common/v/1.1.0
- https://www.npmjs.com/package/ph-common/v/2.0.0
- https://www.npmjs.com/package/ph-common/v/2.0.1
- https://www.npmjs.com/package/ph-common/v/3.0.0

Compromised versions (1)

• = 77.7.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.