nitro-cjs-requirernpm
Advisory published Updated
nitro-cjs-requirer is a confirmed malicious npm package (MAL-2026-17775) that opens a backdoor for remote access (malicious versions 0.0.1, 1.0.0, 1.1.0…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in nitro-cjs-requirer (npm)
What this malware does
The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname(), __dirname install path, process.cwd(), and node version to the hardcoded bare-IP, plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The same fire() call is also invoked at module load from index.js, which otherwise exports a Proxy returning no-op functions for every property so the module appears to be a compatibility shim. Installer host identifiers are therefore sent unconditionally both at npm install (via the postinstall lifecycle hook) and on require(), to a bare-IP endpoint unrelated to any publisher, with no caller opt-in and no documented purpose. The shape — hollow stub module, dual install-time and require-time beacon trigger, hardcoded bare-IP over plain HTTP, host/path/cwd identifiers — is a dependency-confusion or build-pipeline reconnaissance probe.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for nitro-cjs-requirer (6 malicious versions).
If you installed it — respond
nitro-cjs-requirer establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If nitro-cjs-requirer was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks nitro-cjs-requirer-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.