{"schema_version":"1.9.0","id":"MAL-2026-18294","published":"2026-10-25T18:19:29Z","modified":"2026-10-26T06:45:16.105611591Z","summary":"Malicious code in @capsense/ccx-welcome-page (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060)\nThe package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks (preinstall, install, postinstall) to run beacon.js. beacon.js collects os.hostname(), os.userInfo(), and os.platform() and sends the installer's hostname, username, and OS to two hardcoded attacker-controlled collectors: a DNS lookup against the Interactsh OAST subdomain dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro and an HTTPS GET to webhook.site/59675304-bec1-4ca0-8409-8d37b65ec116 with the host identity in the query string. The scope+version combination (public @capsense scope, implausibly high 99.99.100) is the canonical dependency-confusion shape, intended to override a private internal @capsense package during resolution and fire the beacon on any internal build that pulls the public version. The self-label as a 'dependency-confusion PoC' does not change the behavior: any installer whose build resolves this package has their host identity shipped to third-party collectors without consent.\n\n## Source: ossf-package-analysis (08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2)\nThe OpenSSF Package Analysis project identified '@capsense/ccx-welcome-page' @ 99.99.100 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"@capsense/ccx-welcome-page","ecosystem":"npm","purl":"pkg:npm/%40capsense/ccx-welcome-page"},"versions":["99.99.100","99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"1e2950c3e5f1bc27057224195e55566f4909d75b0de8bee9acf64caa280b6df3","tlsh":"7c3155af4638a5245370b1f4c55f412d8af3e278078557d8942cc3519fb983c4253ebc"},{"path":"package.json","sha256":"8065387f0e043d719a2d2900373657a009fb5ce91018b1fd65713e47ab9a5f95","tlsh":"61f0a2245818ab375de202eb1c73196dba718ee693146d08579b4144e34fb9e113b35a"}],"package_integrity":[{"filename":"ccx-welcome-page-99.99.99.tgz","hashes":{"sha1":"f71b57d4069e4404c741ed6082508ae47c3c7526","sha512_sri":"sha512-ubgsdyNFpjuOkPNWdqZ+N67gpBMQzUpdrqayKxkk3Q0FzSfvqa2Kic+N3AR4RfJkJLs1vDIhoTb93S9igrSO+w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@capsense/ccx-welcome-page/MAL-2026-18294.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/ccx-welcome-page/v/99.99.99"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/ccx-welcome-page/v/99.99.100"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-25T18:19:33.499559883Z","modified_time":"2026-10-25T18:19:29Z","sha256":"08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2","source":"ossf-package-analysis","versions":["99.99.100"]},{"id":"IN-MAL-2026-021738","import_time":"2026-10-26T06:39:39.191385525Z","modified_time":"2026-10-26T05:59:34Z","sha256":"0c2b35b8f84afc6a83d56e3705c65c7236bc1d0c51974fabdb68c65c8637ea3d","source":"amazon-inspector","versions":["99.99.99"]},{"id":"IN-MAL-2026-021739","import_time":"2026-10-26T06:39:39.283486083Z","modified_time":"2026-10-26T05:59:41Z","sha256":"0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060","source":"amazon-inspector","versions":["99.99.100"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}