Malicious code in troubleshooting (npm)

troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install, and index.js...

Malicious code in browser-metrics-plugin.contrib (npm)

browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install,...

MSC-2026-12688

The npm package browser-metrics-plugin.contrib version 0.0.1 is a dependency-confusion package with a malicious install hook. package.json declares a postinstall script that runs beacon.cjs, which silently collects the hostname, install path and current working directory and POSTs them to an...

Malicious code in troubleshooting (npm)

troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install, and index.js...

MAL-2026-17641 Malicious code in troubleshooting (npm)

troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install, and index.js...

Malicious code in browser-metrics-plugin.contrib (npm)

browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install,...

MAL-2026-17640 Malicious code in browser-metrics-plugin.contrib (npm)

browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install,...

Malicious Package

Overview browser-metrics-plugin.contrib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...