{"id":"MAL-2026-17806","revision":"8a99b27f91e3467bb11690ee13a61bfd","records":[{"revision":"8a99b27f91e3467bb11690ee13a61bfd","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17806","aliases":[],"title":"Malicious code in ap3-foundations-ui (npm)","description":"ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its `preinstall` hook runs `node index.js` during `npm install`; the script sends the package name and version, hostname, username, home directory, working directory, platform, architecture, and CI flag to `https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587`. The npm account vikkuthetester22 published it on 2026-10-12.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7469eefaab624821647b4e412c4ceac1f422d4857b8484767041fdc355398477)\nThe package's preinstall hook runs index.js, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.homedir(), process.cwd(), os.platform(), os.arch(), and process.env.CI) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587. The behavior fires automatically on `npm install` without caller consent. The package is published at version 99.0.1 under a name consistent with an internal/private namespace, matching the shape of a dependency-confusion beacon used to confirm successful name hijack in a target environment. The exfiltrated fields identify the installing host, user account, working directory, and CI status — information useful for targeting follow-on attacks against the organization whose build pulled the package.\n","state":0,"publishedAt":"2026-10-12T00:57:37+00:00","modifiedAt":"2026-10-13T06:45:04.8580567+00:00","affected":[{"ecosystem":"npm","name":"ap3-foundations-ui","ranges":[],"versions":["99.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/ap3-foundations-ui/v/99.0.1","https://www.npmjs.com/package/ap3-foundations-ui"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17806","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17806","identifiers":["MAL-2026-17806"]},"retained":false,"historicalAffected":[]}],"coverage":[]}