{"schema_version":"1.9.2","id":"MAL-2026-18356","published":"2026-10-27T17:08:01Z","modified":"2026-10-29T13:48:10.498900936Z","summary":"Malicious code in @webapp-shared/login-vmok (npm)","details":"@webapp-shared/login-vmok is a dependency-confusion package: it uses the `@webapp-shared` scope, which matches a private internal package scope, and was published on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1 so that builds resolving the internal name from the public registry install it instead. Its `postinstall` script runs `node beacon.cjs`, which sends an HTTP POST over cleartext HTTP to the hardcoded IP endpoint `http://13.140.137.222:8787/_ah/dc` with the package name, the machine's hostname, the install directory, the current working directory and the Node.js version; the entry point `index.js` sends the same request again whenever the package is loaded and otherwise has no functionality. The beacon code is the same as in other dependency-confusion packages sending to `http://185.158.107.175:8787/_ah/dc` (e.g. MAL-2026-18276), with only the endpoint and package name changed. The inert `0.0.0-stage` and `0.1.0` placeholder versions carry no install script and are not affected. Any machine that installed an affected version has disclosed its hostname and filesystem layout to a third party; remove the package, pin or scope internal package names to the internal registry, and block 13.140.137.222 on build hosts.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (038927c39e3df3caeb1629368073886842fe7abed1413e3ac6d8a215c9cd68bf)\nThe package is a stub with no real functionality (described as a 'compatibility shim') under the scoped name @webapp-shared/ with implausibly high version 99.0.1 — the shape of a dependency-confusion squat. On install, package.json runs `node beacon.cjs` as a postinstall script, and the main entrypoint index.js calls `require('./beacon.cjs').fire()` on load, so the beacon fires both at `npm install` and on any require. beacon.cjs POSTs a JSON payload containing the package name, `os.hostname()`, `__dirname` install path, `process.cwd()`, and `process.version` to the hardcoded bare-IP cleartext HTTP endpoint http://13.140.137.222:8787/_ah/dc. index.js exports a Proxy no-op so consumer builds complete without errors, concealing that the module provides no functionality. The transmitted host identifiers disclose internal hostnames and filesystem paths of installers whose private-registry resolution was captured by the scoped squat, enabling targeted follow-on supply-chain attacks against those environments.\n","affected":[{"package":{"name":"@webapp-shared/login-vmok","ecosystem":"npm","purl":"pkg:npm/%40webapp-shared/login-vmok"},"versions":["1.0.0","1.0.1","1.1.0","2.0.1","3.0.0","99.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"8a717c81e8754a677d6e22be57d9be0a508daf456154e14234ca4ecd2dc3908a","tlsh":"5e3141efa8e5a048aaaa7098c54f1508b27bf4079501af50fd5c82919f7193c37fa8dc"},{"path":"package.json","sha256":"c0c9a128207000114435c9f09cb9cc49afda8f6b69f5c7ce5f7fdb5943752ad5","tlsh":"dad02b309d101d2364c42ed60d672e0a65920d2b05047c043397401c47adb3724ff33d"}],"package_integrity":[{"filename":"login-vmok-99.0.1.tgz","hashes":{"sha1":"738608ed58e02e9e4eda2259e70a879dfa314a7b","sha512_sri":"sha512-uaiWZvsuvWML58G46cof1RirxRtsNTkhO5dt8f67grGxNs10rUGETTUrCN8CBPm8O9f6U5C+6oPi3W4jIQqSOw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@webapp-shared/login-vmok/MAL-2026-18356.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@webapp-shared/login-vmok"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@webapp-shared/login-vmok/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@webapp-shared/login-vmok/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@webapp-shared/login-vmok/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@webapp-shared/login-vmok/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@webapp-shared/login-vmok/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@webapp-shared/login-vmok/v/1.1.0"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"8a717c81e8754a677d6e22be57d9be0a508daf456154e14234ca4ecd2dc3908a"},"note":"postinstall: POSTs hostname, install path, cwd and Node.js version to the IP endpoint","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"},"note":"re-sends the beacon on require and exports a no-op Proxy","paths":["index.js"],"source":"PACKAGE_ARCHIVE"}],"ips":["13.140.137.222"],"urls":["http://13.140.137.222:8787/_ah/dc"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021822","import_time":"2026-10-29T13:14:05.799427942Z","modified_time":"2026-10-29T13:12:18Z","sha256":"038927c39e3df3caeb1629368073886842fe7abed1413e3ac6d8a215c9cd68bf","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-021825","import_time":"2026-10-29T13:14:06.038900984Z","modified_time":"2026-10-29T13:12:42Z","sha256":"0a201187cbfc97bd57a0ae525ef8d938e6cb322f9561e70434c24632907beec0","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-021827","import_time":"2026-10-29T13:14:06.21411111Z","modified_time":"2026-10-29T13:12:55Z","sha256":"29739a571a42a3ebde59a7a60de636c703f420259e9d095cedbe7ebdbeb575f6","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-021821","import_time":"2026-10-29T13:14:05.70953898Z","modified_time":"2026-10-29T13:12:10Z","sha256":"94a4917bc034761da4a8c0c5982a422e75c580ea012e6da0fb823fc7959c9d9d","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-021880","import_time":"2026-10-29T13:37:14.795095657Z","modified_time":"2026-10-29T13:20:01Z","sha256":"55ccc6196cfc6adcffa836c1ad2bc9dbc3dada7b100cbef7e9581f384a0403a8","source":"amazon-inspector","versions":["3.0.0"]},{"id":"IN-MAL-2026-021881","import_time":"2026-10-29T13:37:14.847865598Z","modified_time":"2026-10-29T13:20:08Z","sha256":"883dc978bb7880b9886300ad00be934722382f03ed1427d505a107003a6c931a","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Robin Frehner, Protet","contact":["https://protet.io","mailto:hello@protet.io"],"type":"FINDER"}]}