Malicious Code Vulnerability in @dransay/phone-fix-test Package
Summary
MAL-2026-17698: Malicious code in @dransay/phone-fix-test (npm). Affects @dransay/phone-fix-test versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @dransay/phone-fix-test package is an npm library designed for phone-related functionalities. However, it has been found to contain malicious code that executes during installation, potentially compromising user privacy and security. This vulnerability arises from a preinstall script that sends sensitive network information to an external server.
Vulnerability Detail
The vulnerability originates from the package's preinstall script defined in package.json, which executes 'node beacon.js' during npm install. This script performs a DNS lookup and an HTTPS GET request to a hardcoded subdomain, logging the installing host's IP address and resolver metadata. This behavior constitutes unconsented data exfiltration to a non-first-party collector, posing significant privacy risks to users. The package is published under the @dransay scope on npm, with a version number designed to exploit dependency confusion vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @dransay/phone-fix-testIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the @dransay/phone-fix-test package from public npm. If you need similar functionality, consider using alternative packages that do not exhibit malicious behavior.
Conclusion
The @dransay/phone-fix-test package contains a serious vulnerability that can lead to unauthorized data exfiltration. Users are strongly advised to remove this package and monitor their applications for any potential impacts. Utilizing tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for @dransay/phone-fix-test →
FAQ
The malicious code in the @dransay/phone-fix-test package logs sensitive network information during installation without user consent.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
If you have installed the @dransay/phone-fix-test package, it is advisable to remove it immediately and check for any potential data leaks.
Yes, consider using other npm packages that provide similar functionalities without the malicious behavior.
The vulnerability can lead to unauthorized logging of your IP address and network metadata, compromising your privacy and security.
