{"id":"MAL-2026-18295","revision":"922f78e611ec4f18826abc00ebe7d90e","records":[{"revision":"922f78e611ec4f18826abc00ebe7d90e","observedAt":"2026-10-26T07:21:08.838+00:00","statement":{"source":"osv","id":"MAL-2026-18295","aliases":[],"title":"Malicious code in @capsense/core-ui (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8)\n@capsense/core-ui@99.99.100 is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an organization's internal package of the same scope during resolution. The package's package.json declares preinstall, install, and postinstall lifecycle scripts that all invoke `node beacon.js`. beacon.js uses `os.hostname()`, `os.userInfo()`, and `os.platform()` to collect the installer's hostname, username, and platform, and transmits those identifiers to two attacker-controlled collectors: a subdomain of oast.pro (dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro) via DNS lookup and HTTPS GET, and webhook.site via query string. The beacon fires automatically on every `npm install`, before any code review of the package contents. Framing in the package description as a disclosure/PoC does not change the behavior: a successful dependency-confusion resolution causes installer-identifying data to leave the build or developer machine to third-party endpoints the installer did not configure.\n\n## Source: ossf-package-analysis (8392b3f36f3576b4ce8308df7d98e3cfd6b68b6873116743a022c9940ee4515d)\nThe OpenSSF Package Analysis project identified '@capsense/core-ui' @ 99.99.100 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-10-25T18:54:07+00:00","modifiedAt":"2026-10-26T06:45:15.0562739+00:00","affected":[{"ecosystem":"npm","name":"@capsense/core-ui","ranges":[],"versions":["99.99.100","99.99.99"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@capsense/core-ui/v/99.99.99","https://www.npmjs.com/package/@capsense/core-ui/v/99.99.100"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18295","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18295","identifiers":["MAL-2026-18295"]},"retained":false,"historicalAffected":[]}],"coverage":[]}