{"id":"MAL-2026-18290","kind":"package","aliases":["MAL-2026-18290"],"related":[],"title":"Malicious code in react-native-bright-sdk (npm)","description":"react-native-bright-sdk 9000.0.0 is a dependency-confusion package that squats the name of a React Native SDK that is distributed privately as a tarball outside the npm registry. Its `preinstall` script runs `node canary.js`, which collects the machine's hostname and a timestamp, base64-encodes them and sends them in an HTTPS GET request to `https://estimator-nemeses-unwatched.ngrok-free.dev/canary` on install. The package describes itself as a \"namespace reservation / canary\" and contains no other functionality. The version number 9000.0.0 makes it outrank any private release of the same name in a project whose dependency resolution falls back to the public registry. The request does not read the response or set a timeout, so the install can hang. It was published on 2026-10-22, after an inert `0.0.0-stage` placeholder (not affected). Any machine that installed this version has disclosed its hostname to a third party; remove the package, and check that private package names are pinned to or scoped to the internal registry.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55)\nThe package declares a preinstall lifecycle hook that executes canary.js on `npm install`. The script collects os.hostname() and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS GET to the hardcoded endpoint https://estimator-nemeses-unwatched.ngrok-free.dev/canary. The destination is an anonymous, ephemeral ngrok tunnel unrelated to any legitimate publisher infrastructure, and the beacon fires automatically without user opt-in. The package ships no functional code justifying this network activity; it exists only to send the install signal. The version number (9000.0.0) and name resemble a dependency-confusion / namespace-reservation shape targeting internal package resolution.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"react-native-bright-sdk","fixed":[],"affected":"= 9000.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-22T23:01:30+00:00","first_seen_at":"2026-10-26T20:51:53+00:00","triaged_at":"2026-10-26T20:57:54+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':149C '-18290':12A,15A '-2026':11A,14A '-22':150C '/canary':85C '/canary.':244C '0.0.0':154C '2026':148C '4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55':204C '9000.0.0':28C,105C,290C 'activ':278C 'affect':158C 'amazon':202C 'amazon-inspector':201C 'anonym':249C 'automat':263C 'back':123C 'base64':71C,227C 'base64-encodes':70C,226C 'beacon':261C 'bright':7A,19A,26C 'canari':96C 'canary.js':60C,214C 'check':177C 'code':2A,274C 'collect':62C,220C 'confus':33C,297C 'contain':98C 'declar':207C 'depend':32C,120C,296C 'dependency-confus':31C,295C 'describ':90C 'destin':246C 'detail':193C 'disclos':166C 'distribut':46C 'edit':196C 'encod':72C,228C 'endpoint':241C 'ephemer':250C 'estimator-nemeses-unwatched.ngrok-free.dev':84C,243C 'estimator-nemeses-unwatched.ngrok-free.dev/canary':83C 'estimator-nemeses-unwatched.ngrok-free.dev/canary.':242C 'execut':213C 'exist':280C 'fall':122C 'fire':262C 'function':101C,273C 'get':80C,237C 'hang':143C 'hardcod':240C 'hook':211C 'hostnam':66C,168C 'https':79C,236C 'inert':153C 'infrastructur':258C 'inspector':203C 'instal':87C,141C,162C,217C,224C,285C 'intern':189C,303C 'json':230C 'justifi':275C 'legitim':256C 'lifecycl':210C 'line':199C 'machin':64C,160C 'make':106C 'mal':10A,13A 'malici':1A,21B 'name':38C,115C,181C,292C 'namespac':94C,299C 'namespace-reserv':298C 'nativ':6A,25C,42C 'native':18A 'network':277C 'ngrok':251C 'node':59C 'npm':9A,53C,216C 'number':104C,289C 'opt':267C 'opt-in':266C 'os.hostname':221C 'outrank':108C 'outsid':51C 'packag':22B,34C,89C,175C,180C,206C,270C,304C 'parti':172C 'payload':231C 'per':191C 'pin':183C 'placehold':156C 'preinstal':56C,209C 'privat':47C,110C,179C 'project':118C 'public':126C 'publish':146C,257C 'react':5A,17A,24C,41C 'react-native-bright-sdk':4A,16A,23C 'read':132C 'registri':54C,127C,190C 'releas':111C 'remov':173C 'request':81C,129C 'resembl':293C 'reserv':95C,300C 'resolut':121C,305C 'respons':134C 'run':58C 'scope':186C 'script':57C,219C 'sdk':8A,20A,27C,43C 'send':75C,283C 'set':136C 'shape':301C 'ship':271C 'signal':286C 'sourc':192C,200C 'squat':36C 'stage':155C 'tarbal':50C 'target':302C 'third':171C 'timeout':138C 'timestamp':69C,225C 'transmit':233C 'tunnel':252C 'unrel':253C 'user':265C 'version':103C,164C,288C 'via':235C 'whose':119C 'without':264C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T23:01:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18290","url":"https://osv.dev/vulnerability/MAL-2026-18290","severity":"critical","published_at":"2026-10-22T23:01:30+00:00","modified_at":"2026-10-26T03:30:06+00:00","first_seen_at":"2026-10-26T20:51:53+00:00","fetched_at":"2026-10-26T20:51:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}