ecobee2 @0.0.2
Vulnerability report · Last retrieved from osv.dev August 26, 2026 at 3:21 AM UTC
OSV ID
MAL-2026-14476
Ecosystem
npm
Summary
package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to http://169.58.96.170:9001/cb with the installer's os.hostname() and the package name in the query string, disclosing host identity to a hardcoded bare-IP endpoint over cleartext HTTP at install time. The package README is a placeholder and no legitimate purpose is documented for this network activity.
Source: amazon-inspector (42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.