{"schema_version":"1.9.0","id":"MAL-2026-18274","published":"2026-10-25T14:28:47Z","modified":"2026-10-26T03:30:05.195769574Z","summary":"Malicious code in @ppa-web-components/ppa-headerfooter (npm)","details":"@ppa-web-components/ppa-headerfooter is a dependency-confusion package: it is described as a \"Compatibility shim\", uses inflated version numbers, and its README calls it an \"authorized dependency-confusion test\". Each listed version (1.0.0, 2.0.1, 2.0.0, 1.0.1, 99.0.1, 3.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce)\nThe package ships a `beacon.cjs` script wired as both the `postinstall` lifecycle hook (`node beacon.cjs`) and a require-time side effect from `index.js`. On install and on `require()`, the beacon POSTs installer identifiers — `os.hostname()`, the install path (`__dirname`), `process.cwd()`, `process.version`, and the package name — to the hardcoded bare-IP plaintext HTTP endpoint `http://185.158.107.175:8787/_ah/dc`. The package otherwise provides no functionality: `index.js` exports a Proxy that returns a no-op function for every property access, so the beacon is the sole purpose of the package. The combination of a scoped name resembling a web-components namespace, a 'Compatibility shim' description, a functionless Proxy stub, and a bare-IP recon beacon is the shape of a dependency-confusion / typosquat probe measuring where the package resolves inside private build environments, typically preceding a targeted follow-up payload.\n","affected":[{"package":{"name":"@ppa-web-components/ppa-headerfooter","ecosystem":"npm","purl":"pkg:npm/%40ppa-web-components/ppa-headerfooter"},"versions":["1.0.1","2.0.1","1.1.0","99.0.1","2.0.0","3.0.0","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f","tlsh":"a83161eba8e0a0089aa67098d54f1409f27bf0069501ab54fd5c82959f7257c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}],"package_integrity":[{"filename":"ppa-headerfooter-1.0.1.tgz","hashes":{"sha1":"40195217b72ecde0b78ce50eb77fed04f2b597d1","sha512_sri":"sha512-3h0XWkSFT8l/ntSxFhegxFu037nNGb729nHG6zEDlRtD322ch/ETFpkrQCTpMtTbKfNgXRS4+VQcZZrka/4gjA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-headerfooter/MAL-2026-18274.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"},"note":"Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions and in ph-common (MAL-2026-1809).","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"1c2dcafdb5f7c385336754e75a495b3d79e313b7d20b28ac1c1cdb73f943fa28"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-headerfooter@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-headerfooter@1.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"e62e0006fe7a6a0fd079770b4dc421eb1189e5f01974617d6655ae15f946ea4d"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-headerfooter@2.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-headerfooter@2.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"43693feaea6721aa0a85514b9b31e4649b7f17e6b9e25dc19a75a34c6d8150dc"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-headerfooter@2.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-headerfooter@2.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"0ad5105750efd99e2ab19715878eb50b313c3fb120dff2f286988e5644483fc4"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-headerfooter@1.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-headerfooter@1.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"898d044a87d2631278e801bcbd0221f9db3fbb56da692e3e44ce66bcf20ae192"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-headerfooter@99.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-headerfooter@99.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"34648c9026e505318968bcf85fb229ca4975aa5f9ce567ed2ba91f873c335780"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-headerfooter@3.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-headerfooter@3.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"}],"ips":["185.158.107.175"],"urls":["http://185.158.107.175:8787/_ah/dc"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021647","import_time":"2026-10-25T14:39:51.59404739Z","modified_time":"2026-10-25T14:37:48Z","sha256":"32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-021649","import_time":"2026-10-25T14:39:51.651410314Z","modified_time":"2026-10-25T14:38:03Z","sha256":"9e7bd7ef6876f524713cbb7f67f93a04096f1184296e033f38c02ad4644b363d","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-021644","import_time":"2026-10-25T14:39:51.501599532Z","modified_time":"2026-10-25T14:37:25Z","sha256":"a9b42b08ad4bc0eff74e33aaa1ef0dc69af53c215655790c89957f04d5469557","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-021645","import_time":"2026-10-25T14:39:51.536740834Z","modified_time":"2026-10-25T14:37:34Z","sha256":"3b94cf7469c54847b45c215abeb823c5af606e01f2518d3288bf25dc69504e97","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-021646","import_time":"2026-10-25T14:39:51.565278925Z","modified_time":"2026-10-25T14:37:41Z","sha256":"3f8383e1c9b3c497ee3b225ad4d5b27f02d9a5f75470921cd9e25f13221dfab8","source":"amazon-inspector","versions":["2.0.0"]},{"id":"IN-MAL-2026-021648","import_time":"2026-10-25T14:39:51.621557724Z","modified_time":"2026-10-25T14:37:56Z","sha256":"4c37eba03dca2da218b616b3ca2091fdc9f2aa3e18a85a298e10c3dff712b46d","source":"amazon-inspector","versions":["3.0.0"]},{"id":"IN-MAL-2026-021654","import_time":"2026-10-25T14:39:51.800208916Z","modified_time":"2026-10-25T14:38:38Z","sha256":"8a556618b8d34db0a7655bc99411ba764fee437890ea374ad2f05fd96657db45","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}