{"schema_version":"1.9.0","id":"MAL-2026-18295","published":"2026-10-25T18:54:07Z","modified":"2026-10-26T06:45:15.056273854Z","summary":"Malicious code in @capsense/core-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8)\n@capsense/core-ui@99.99.100 is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an organization's internal package of the same scope during resolution. The package's package.json declares preinstall, install, and postinstall lifecycle scripts that all invoke `node beacon.js`. beacon.js uses `os.hostname()`, `os.userInfo()`, and `os.platform()` to collect the installer's hostname, username, and platform, and transmits those identifiers to two attacker-controlled collectors: a subdomain of oast.pro (dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro) via DNS lookup and HTTPS GET, and webhook.site via query string. The beacon fires automatically on every `npm install`, before any code review of the package contents. Framing in the package description as a disclosure/PoC does not change the behavior: a successful dependency-confusion resolution causes installer-identifying data to leave the build or developer machine to third-party endpoints the installer did not configure.\n\n## Source: ossf-package-analysis (8392b3f36f3576b4ce8308df7d98e3cfd6b68b6873116743a022c9940ee4515d)\nThe OpenSSF Package Analysis project identified '@capsense/core-ui' @ 99.99.100 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"@capsense/core-ui","ecosystem":"npm","purl":"pkg:npm/%40capsense/core-ui"},"versions":["99.99.100","99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"463fb500d63bacd466cc4acb6f091516441f418b602b3b3bb643b0d674c17b7e","tlsh":"d43131ef4239a5205370b0f4c54f41298af3e2a9068657d8942cc3919fb58398263ebc"},{"path":"package.json","sha256":"5e3855ee9eb0000134c9064ef387d0c949883b64b330bc85f89e11a3cd329076","tlsh":"00f0a22458186b3369e201eb1c73196dba718ee693146d08579b4144e34fbae113b35b"}],"package_integrity":[{"filename":"core-ui-99.99.99.tgz","hashes":{"sha1":"6d7990eb2765fa6cf2027f4cfa28e3168da339b0","sha512_sri":"sha512-xpHp6nvlS79TRI73lyQMP/1ddZBg2HiVMnJxO/71zbC7caaYrhQEtOZp31SlHFaLwVsauV7RWTRxOMOE8c9a9Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@capsense/core-ui/MAL-2026-18295.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/core-ui/v/99.99.99"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/core-ui/v/99.99.100"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-25T19:13:10.770315337Z","modified_time":"2026-10-25T18:54:07Z","sha256":"8392b3f36f3576b4ce8308df7d98e3cfd6b68b6873116743a022c9940ee4515d","source":"ossf-package-analysis","versions":["99.99.100"]},{"id":"IN-MAL-2026-021742","import_time":"2026-10-26T06:39:39.533360965Z","modified_time":"2026-10-26T06:00:02Z","sha256":"22a2552290762ac96558a876b15456f4a40c4db102a29ccc081ab5f5b884c61d","source":"amazon-inspector","versions":["99.99.99"]},{"id":"IN-MAL-2026-021740","import_time":"2026-10-26T06:39:39.351873331Z","modified_time":"2026-10-26T05:59:50Z","sha256":"cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8","source":"amazon-inspector","versions":["99.99.100"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}