CERT24MAL-2026-18214 — Malicious code in @grabcad/company-server-shared (npm)Loading data…
CERT24Threat Observatory
Period

MAL-2026-18214 — Malicious code in @grabcad/company-server-shared (npm)

The package describes itself as a compatibility shim for the @grabcad scope but provides no real functionality. During installation, its postinstall script runs beacon.cjs, and index.js invokes the same routine when the module is required. It sends the hostname, installation path, working directory, and Node.js/npm version over HTTP to http://185.158.107.175:8787/_ah/dc. The source describes this as the standard shape of a dependency-confusion attack targeting the private @grabcad scope.

← Back to intelligence

MAL-2026-18214 — Malicious code in @grabcad/company-server-shared (npm)

The package describes itself as a compatibility shim for the @grabcad scope but provides no real functionality. During installation, its postinstall script runs beacon.cjs, and index.js invokes the same routine when the module is required. It sends the hostname, installation path, working directory, and Node.js/npm version over HTTP to http://185.158.107.175:8787/_ah/dc. The source describes this as the standard shape of a dependency-confusion attack targeting the private @grabcad scope.