{"id":"MAL-2026-18273","revision":"c8e4e27de0c2405d9305ec78925ca5f9","records":[{"revision":"c8e4e27de0c2405d9305ec78925ca5f9","observedAt":"2026-10-25T15:17:13.872+00:00","statement":{"source":"osv","id":"MAL-2026-18273","aliases":[],"title":"Malicious code in @ppa-web-components/ppa-builder (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (132a763229562f58056a9865006e3645b39657374a953534c63474e8ad54f8be)\nThe package is a shim with no functional code: its main module exports a Proxy that returns a no-op function for every property, so any import of the scoped name succeeds silently. A postinstall script (beacon.cjs) and the main module both POST host-identifying data — package name, os.hostname(), __dirname install path, process.cwd(), and process.version — to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The beacon fires automatically on npm install via the postinstall lifecycle hook and again on require() of the main entry, with no opt-in and no documentation. The destination is not a first-party or vendor-affiliated host, and the scoped name resembles a legitimate component library, consistent with a dependency-confusion / typosquat reconnaissance beacon.\n","state":0,"publishedAt":"2026-10-25T14:39:39+00:00","modifiedAt":"2026-10-25T14:45:04.6610091+00:00","affected":[{"ecosystem":"npm","name":"@ppa-web-components/ppa-builder","ranges":[],"versions":["99.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@ppa-web-components/ppa-builder/v/99.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18273","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18273","identifiers":["MAL-2026-18273"]},"retained":false,"historicalAffected":[]}],"coverage":[]}