{"id":"MAL-2026-18372","revision":"42d548050ea7482681f9cd43d11e338f","records":[{"revision":"42d548050ea7482681f9cd43d11e338f","observedAt":"2026-10-29T09:48:08.617+00:00","statement":{"source":"osv","id":"MAL-2026-18372","aliases":[],"title":"Malicious code in @zmtcdn/components (npm)","description":"@zmtcdn/components@9999.0.0 is a dependency-confusion package with an empty `index.js` and a description of \"Security research PoC\". Its postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025`. It was published by the npm account kill_shs, which also published @zmtcdn/ui with the same script.","state":0,"publishedAt":"2026-10-28T09:59:37+00:00","modifiedAt":"2026-10-29T09:15:04.995816+00:00","affected":[{"ecosystem":"npm","name":"@zmtcdn/components","ranges":[],"versions":["9999.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@zmtcdn/components"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18372","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18372","identifiers":["MAL-2026-18372"]},"retained":false,"historicalAffected":[]}],"coverage":[]}