{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ]
      },
      "package": {
        "ecosystem": "npm",
        "name": "@flexmr/ui"
      },
      "versions": [
        "99.99.99"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://www.invisirisk.com",
        "mailto:research@invisirisk.com"
      ],
      "name": "InvisiRisk, Inc.",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "oob.recon.dev"
      ],
      "files": [
        {
          "digests": {
            "sha256": "1f2f8a19a112cf6e024d832449377f596b5cbebb6fe548cfc2cc8f0cdab0e775"
          },
          "note": "preinstall script: node beacon.js preinstall; install script: node beacon.js install; postinstall script: node beacon.js postinstall",
          "paths": [
            "package.json"
          ],
          "source": "PACKAGE_ARCHIVE"
        },
        {
          "digests": {
            "sha256": "bdee8d65c1c5b40df70e851eda298aa0729f0a618e11d702a6e9a35285c4e2c3"
          },
          "note": "Executed by the preinstall, install and postinstall scripts of @flexmr/ui@99.99.99.",
          "paths": [
            "beacon.js"
          ],
          "source": "PACKAGE_ARCHIVE"
        }
      ],
      "ips": [
        "177.7.60.239"
      ],
      "urls": [
        "http://177.7.60.239:48080"
      ]
    }
  },
  "details": "`@flexmr/ui@99.99.99` runs `node beacon.js preinstall`, `node beacon.js install`, and `node beacon.js postinstall` during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to `177.7.60.239:48080` and encode the hostname in a DNS query under `oob.recon.dev`, probing whether a build resolves the package from the public npm registry; it was published on 2026-10-13.",
  "id": "MAL-2026-17879",
  "modified": "2026-10-14T07:08:29Z",
  "published": "2026-10-13T20:15:56Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@flexmr/ui"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @flexmr/ui (npm)"
}