{"schema_version":"1.9.0","id":"MAL-2026-18287","published":"2026-10-25T14:21:12Z","modified":"2026-10-26T03:30:06.165204986Z","summary":"Malicious code in @ppa-web-components/ppa-searchform (npm)","details":"@ppa-web-components/ppa-searchform is a dependency-confusion package: it is described as a \"Compatibility shim\", uses inflated version numbers, and its README calls it an \"authorized dependency-confusion test\". Each listed version (1.0.0, 1.0.1, 2.0.1, 0.0.1, 3.0.0, 1.1.0, 99.0.1, 2.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c)\nThe package ships a `beacon.cjs` that is wired to run both via the `postinstall` lifecycle script and from top-level `index.js` on `require()`. On execution it collects host identifiers (hostname, install path, current working directory, Node.js version) and POSTs them to a hardcoded bare-IPv4 endpoint over plaintext HTTP at http://185.158.107.175:8787/_ah/dc. The destination is not a publisher-owned domain. The package's `index.js` exports a `Proxy` that returns no-op functions for every property access, so the module provides no real functionality — its only effect on install or import is the beacon callback. The combination of a non-functional shim under an organisation-shaped scope with a reconnaissance beacon fired at install and import time is the fingerprint of a dependency-confusion / namesquat probe that reports successful resolution and build inside a victim's environment.\n","affected":[{"package":{"name":"@ppa-web-components/ppa-searchform","ecosystem":"npm","purl":"pkg:npm/%40ppa-web-components/ppa-searchform"},"versions":["0.0.1","2.0.1","3.0.0","99.0.1","2.0.0","1.0.1","1.0.0","1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f","tlsh":"dc3161eba8f0a0089aaa7098c54f1409b27bf0069501af50fd5c82919f7297c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}],"package_integrity":[{"filename":"ppa-searchform-0.0.1.tgz","hashes":{"sha1":"6d54e03bae1d9ac657d6f0545462fd33c3d122a7","sha512_sri":"sha512-wKiqX/AX5gfk2XJSfEDlca9ZS+F+CddA2fWrqKRo0pUHhe1Ii8BZaPxkhm6i7h9XPPUQWTBNES3l886EtiqjcA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-searchform/MAL-2026-18287.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"},"note":"Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions and in ph-common (MAL-2026-1809).","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"c2f75dd4f04eac8c77164712e6274635684c02545d15b8f29e0ade26425e1e81"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@1.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"472db6a0c61115a39591965e6fd5186883e23cfa22332c9f5d2b3e805ef69ecf"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@1.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@1.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"505d9593de08ea5f20debcf32015fd79e9edb7ed633ac1ed12d35bb535e5e44c"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@2.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@2.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"1c32f58b989d4e107abbfc54fa1ff2e702a3de3016eb9dd7b6644fbac4551ad4"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@0.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@0.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"6ea3fc306d3bf4d00f5e353048b94be2d7524dc9b19424eddf0ad28b9924c70d"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@3.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@3.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"14fd2f958d3f66cc94033fddaffe517b506943c88c176ed3f818fede427af505"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@1.1.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@1.1.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"fe26ae9487f6c2b3e87fa1b46e5348901a617b97bafe74442040f57b40269e7b"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@99.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@99.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"3ae4df1953b72652dce4b686378923ed104faa1fcd5756625bcbbdb1352c2a42"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@ppa-web-components/ppa-searchform@2.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},"note":"Executed by the postinstall script of @ppa-web-components/ppa-searchform@2.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"}],"ips":["185.158.107.175"],"urls":["http://185.158.107.175:8787/_ah/dc"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021671","import_time":"2026-10-25T15:15:12.140088669Z","modified_time":"2026-10-25T14:40:48Z","sha256":"06065b974e1025f447c2880c0b2e3b746ae706ca19aed737af56bf00a52a8d04","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-021670","import_time":"2026-10-25T15:15:12.014489114Z","modified_time":"2026-10-25T14:40:42Z","sha256":"6748411f06b397e32c53e7be874186ad7742b6aeab92813685e00e2f243df56e","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-021675","import_time":"2026-10-25T15:15:12.57283105Z","modified_time":"2026-10-25T14:41:17Z","sha256":"a30ec0bc7e5ce23161923c64771ac09af354713275b6901394d486f9dac8b1db","source":"amazon-inspector","versions":["3.0.0"]},{"id":"IN-MAL-2026-021674","import_time":"2026-10-25T15:15:12.467755671Z","modified_time":"2026-10-25T14:41:09Z","sha256":"ae158cc433dc18d2e0573be61e833ea018f020e8341774cc4ca051bf98d2ce32","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-021672","import_time":"2026-10-25T15:15:12.237958917Z","modified_time":"2026-10-25T14:40:54Z","sha256":"c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c","source":"amazon-inspector","versions":["2.0.0"]},{"id":"IN-MAL-2026-021676","import_time":"2026-10-25T15:15:12.676821181Z","modified_time":"2026-10-25T14:41:30Z","sha256":"cb780f2b1bbd30330912f5d3d113a3485769aa28788f4b31fb5de45f55ce3de9","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-021669","import_time":"2026-10-25T15:15:11.876574537Z","modified_time":"2026-10-25T14:40:34Z","sha256":"3c7ec1dc7dadbe1ead7bd25f527ccefa573c551b7a090b44dbcf00c3e25d1f0c","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-021673","import_time":"2026-10-25T15:15:12.349740309Z","modified_time":"2026-10-25T14:41:00Z","sha256":"6131142f8331a79d71661068d7befb1fe73b56d2347b9b3cc52aea58c4b1c9e7","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}