{"schema_version":"1.9.2","id":"MAL-2026-18372","published":"2026-10-28T09:59:37Z","modified":"2026-10-29T09:15:04.995815975Z","summary":"Malicious code in @zmtcdn/components (npm)","details":"@zmtcdn/components@9999.0.0 is a dependency-confusion package with an empty `index.js` and a description of \"Security research PoC\". Its postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025`. It was published by the npm account kill_shs, which also published @zmtcdn/ui with the same script.","affected":[{"package":{"name":"@zmtcdn/components","ecosystem":"npm","purl":"pkg:npm/%40zmtcdn/components"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/components/MAL-2026-18372.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zmtcdn/components"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"83ecde574a04b04277a0db8cc868bab08f2222f20183de92a6242433340c08ea"},"note":"postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/components@9999.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"fe334f5ef07787eb80c479592ce2834c0644731f14d74422b6a8ee68d94f1bf0"},"note":"Executed by the postinstall script of @zmtcdn/components@9999.0.0.","paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025"]}},"credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}